CVE-2026-34216— CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php
Quick assessment
Affected
Ctrlpanel-gg panel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CtrlPanel.gg是CtrlPanel.gg开源的一款主机服务计费管理工具。 CtrlPanel.gg 1.1.1及之前版本存在安全漏洞，该漏洞源于管理设置更新端点接受用户提供的类名并用于动态调用，未进行白名单验证，导致认证远程代码执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Ctrlpanel-gg | panel | < 1.2.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-34216
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.php
Source: CVE Program / CVE List V5
Vulnerability Description
CtrlPanel is open-source billing software for hosting providers. In versions 1.1.1 and prior, the admin settings update endpoint accepted a fully qualified class name directly from user-supplied request input and used it for dynamic static method calls and object instantiation without any allowlist validation, allowing for authenticated Remote Code Execution. An authenticated admin-level user could supply an arbitrary class name available in the Composer autoloader, potentially triggering unintended constructor or magic method execution. The update() method reads settings_class directly from the HTTP request and passed it to new $settings_class() and $settings_class::getValidations() without verifying that the provided value corresponds to a legitimate settings class: Because PHP resolves class names against the Composer autoloader at runtime, any autoloadable class in the application or its dependencies could be instantiated. Depending on the classes available in the dependency tree, this can trigger unintended side effects through constructors or magic methods (__construct, __toString, __wakeup), following a PHP object injection / gadget chain pattern. This issue has been fixed in version 1.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: CVE Program / CVE List V5
Vulnerability Title
CtrlPanel.gg 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
CtrlPanel.gg是CtrlPanel.gg开源的一款主机服务计费管理工具。 CtrlPanel.gg 1.1.1及之前版本存在安全漏洞，该漏洞源于管理设置更新端点接受用户提供的类名并用于动态调用，未进行白名单验证，导致认证远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Ctrlpanel-gg | panel | < 1.2.0 | - |
|
II. Public POCs for CVE-2026-34216
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-34216
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-34216 (1)
Other References for CVE-2026-34216 (1)
-
🔗 Release 1.2.0 · Ctrlpanel-gg/panel · GitHub x_refsource_MISC
Same Patch Batch · Ctrlpanel-gg · 2026-05-19 · 6 CVEs total
| CVE-2026-34234 | 10.0 CRITICAL | CtrlPanel: Unauthenticated RCE using installer script |
| CVE-2026-34241 | 8.7 HIGH | CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking |
| CVE-2026-34358 | 8.1 HIGH | CtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass |
| CVE-2026-34233 | 6.5 MEDIUM | CtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints |
| CVE-2026-34246 | 4.8 MEDIUM | CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output |
IV. Related Vulnerabilities
Same product: panel
-
CVE-2026-92762
Pelican Panel before 1.0.0-beta35 Authorization Bypass via S -
CVE-2026-86177
Pterodactyl Panel before 1.14.1 Privilege Escalation via Sch -
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA -
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload -
CVE-2026-35202
Pterodactyl has a database resource limit bypass via race co
Same vendor: Ctrlpanel-gg
-
CVE-2026-34358
CtrlPanel: Missing Authorization on Admin Write Endpoints Al -
CVE-2026-34246
CtrlPanel: Stored XSS in Admin Role Management via Unescaped -
CVE-2026-34241
CtrlPanel: Stored XSS in Ticket Reply Notifications Allows S -
CVE-2026-34234
CtrlPanel: Unauthenticated RCE using installer script -
CVE-2026-34233
CtrlPanel has Missing Authentication Checks in Datatable Adm
Same weakness: CWE-470
-
CVE-2026-102094
Kiteworks Email Protection Gateway unsafe reflection -
CVE-2026-102580
Moodle: arbitrary class instantiation via report builder aud -
CVE-2026-96740
Streamshub/console: console-operator: streams for apache kaf -
CVE-2026-101292
Artemis-core-client: unsafe reflection in apache activemq ar -
CVE-2026-96672
Frappe ERPNext before 16.34.1 Unauthorized Method Invocation
V. Comments for CVE-2026-34216
No comments yet