Live › vulnerability › CVE-2026-73695
Control Web Panel (CWP) before webpanel_version 1.16 builds an include path from an attacker-supplied module name without sanitization. An attacker can use directory traversal sequences to include arbitrary local PHP files, which can lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Servers running Control Web Panel (CWP) before webpanel_version 1.16 are exposed, since the flaw is in services/users/index.php. Hosts already on 1.16 or later, or not running CWP, can skip it. Whether unauthenticated requests reach the vulnerable file is not stated in the sources.
No product ranges from the sources yet.
1.16.services/users/index.php in the CWP installation for the unsanitized module name include.1.16 or later, as stated in the advisory description.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.
This page as .md · .json · in your agent: get_signal("CVE-2026-73695")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.