Unsafe Dynamic Class Instantiation in CtrlPanel-gg/panel Leading to Potential RCE (CVE-2026-3426)

Vulnerability Summary: Unsafe Dynamic Class Instantiation in Admin Settings Vulnerability Overview Title: Unsafe Dynamic Class Instantiation in Admin Settings Allows Potential Remote Code Execution CVE ID: CVE-2026-3426 CVSS Score: 6.6 / 10 Affected Software: (Composer) Affected Versions: Fixed Version: Description: The admin settings update endpoint accepts a fully qualified class name and directly uses it for dynamic static method calls and object instantiation without any validation. An authenticated administrator-level user can provide an arbitrary class name, triggering unexpected constructor or magic method execution. Technical Details: In , the method reads directly from the HTTP request and passes it to and without verifying whether the provided value corresponds to a legitimate admin settings class. Impact Scope Attacker Requirements: Requires a user with admin settings write permissions to be logged in. Potential Consequences: Worst Case: If a suitable gadget chain exists in dependencies, it can lead to remote code execution, arbitrary file read/write, or server-side request forgery. General Case: Unexpected constructor side effects may cause application instability or information disclosure. Risk Amplification: The risk is higher in environments with extensive admin delegation or where admin credentials might be compromised. Remediation The fix introduces a server-side "category-to-class" mapping built by scanning and extension settings classes. This mapping only includes subclasses of . The value from the request is validated against this mapping before instantiation. POC / Exploit Code 1. Vulnerable Code (Before Fix) 2. Exploit Request (PoC) 3. Fixed Code**

Goal Reached Thanks to every supporter — we hit 100%!

Unsafe Dynamic Class Instantiation in CtrlPanel-gg/panel Leading to Potential RCE (CVE-2026-3426)

More from this source