clpctl user:reset:password fails with passwords containing a dollar sign ($)

[wordpressdevlopers]

CloudPanel version(s) affected

2.5.4 (package 2.5.4-3+clp-bookworm)

Description

Setting an admin/user password that contains the "$" character through the clpctl CLI
(user:reset:password or user:add) reports success, but the password is stored incorrectly,
so logging into the web UI with that exact password fails.

Setting the identical password through the web UI works normally — so the defect is specific
to the clpctl CLI path. It looks like clpctl performs shell/variable interpolation on the
--password value (expanding "$..." before hashing), even when the value is passed literally
inside single quotes.

How to reproduce

Environment: Debian 12, CloudPanel 2.5.4.

1. Set the admin password via clpctl. Single quotes guarantee the login shell passes "$"
   literally (no shell expansion on our side):

   clpctl user:reset:password --userName='admin' --password='Abcd1234$XYZ'

   Output: Password for "admin" has been reset.

2. Open https://:8443 and log in as "admin" with Abcd1234$XYZ
   -> login FAILS.

3. Now set the SAME password from the web UI (Admin Area -> Users -> edit admin),
   then log in with Abcd1234$XYZ
   -> works.

4. Set a password that differs ONLY by replacing "$" with another symbol, via clpctl:

   clpctl user:reset:password --userName='admin' --password='Abcd1234%XYZ'

   Log in with Abcd1234%XYZ
   -> works.

Only the "$" variant fails, and only via clpctl. Because step 1 uses single quotes, the login
shell is not responsible — the corruption happens inside clpctl.

Possible Solution

No response

Additional Context

No response