# CVE-2021-45467: CentOS Web Panel - Authorization Bypass

> Live exploitation tracking for CVE-2021-45467 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-45467

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** CentOS Web Panel
- **Weaknesses:** CWE-862 (Missing Authorization)
- **Tags:** enterprise_software, management_panel

## Description

In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi URI. Any number of %00 instances can be used, e.g., .%00%00%00./.%00%00%00./api/account_new_create could also be used for the scripts parameter.

## CrowdSec analysis

[CVE-2021-45467](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-45467) is a critical vulnerability in CWP (Control Web Panel) before version 0.9.8.1107 that allows unauthenticated attackers to exploit null byte injection in /user/loader.php, enabling them to register arbitrary API keys. This flaw can be leveraged for remote code execution, unauthorized access, or further compromise of the affected server.

CrowdSec has been tracking this vulnerability and its exploits since 26th of November 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2021-45467 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/user/index.php` and `/user/login.php` endpoints by injecting null bytes (`%00`) and directory traversal sequences into the `scripts` parameter to access sensitive files or execute arbitrary actions. These requests often contain multiple `.%00%00%00./` patterns targeting files like `/etc/passwd`.

## Timeline

- 2022-12-26: CVE Published. CVE-2021-45467 is published to NVD.
- 2025-11-26: Rule Released. CrowdSec releases a rule to detect CVE-2021-45467 exploitation attempts against the CrowdSec Network.
- 2026-01-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-45467 for the first time.

## References

- https://control-webpanel.com/changelog
- https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-45467.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-45467) follows observed exploitation activity for CVE-2021-45467. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.