{"id":"CVE-2026-73695","kind":"vulnerability","aliases":["CVE-2026-73695"],"related":[],"title":"Control Web Panel: path traversal lets attackers include arbitrary PHP files","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.","summary":"Control Web Panel (CWP) before webpanel_version 1.16 builds an include path from an attacker-supplied module name without sanitization. An attacker can use directory traversal sequences to include arbitrary local PHP files, which can lead to code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","cwp","php","runtime","self-hosted"],"not_affected_if":["webpanel-1.16-or-later"],"how_to_check":"- Check the installed CWP webpanel version and confirm whether it is below `1.16`.\n- Review `services/users/index.php` in the CWP installation for the unsanitized module name include.","fix":"- Move CWP to `1.16` or later, as stated in the advisory description.","status":"open","published_at":"2026-11-02T15:17:37+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:25:39+00:00","updated_at":"2026-11-02T15:25:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T15:25:39Z","model":"claude-haiku-5-5","output":{"fix":"- Move CWP to `1.16` or later, as stated in the advisory description.","reach":"internet","title":"Control Web Panel: path traversal lets attackers include arbitrary PHP files","impact":"high","summary":"Control Web Panel (CWP) before webpanel_version 1.16 builds an include path from an attacker-supplied module name without sanitization. An attacker can use directory traversal sequences to include arbitrary local PHP files, which can lead to code execution on the server.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["control-web-panel","cwp","php","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker includes local PHP files, potentially running code on the server","analyst_note":"Confirm whether the module name parameter is reachable without authentication and whether the vulnerable path is exposed by default; check the VulnCheck advisory linked from the NVD entry.","how_to_check":"- Check the installed CWP webpanel version and confirm whether it is below `1.16`.\n- Review `services/users/index.php` in the CWP installation for the unsanitized module name include.","plain_action":"","needs_analyst":true,"not_affected_if":["webpanel-1.16-or-later"],"who_is_affected":"Servers running Control Web Panel (CWP) before webpanel_version 1.16 are exposed, since the flaw is in services/users/index.php. Hosts already on 1.16 or later, or not running CWP, can skip it. Whether unauthenticated requests reach the vulnerable file is not stated in the sources.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000715,"input_tokens":4179,"output_tokens":595,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-73695':14A,17A '1.16':35B,78C 'allowlist':102C 'arbitrari':9A,58B,120C 'attack':7A,43B,50B,89C,108C 'attacker-suppli':42B,88C 'basenam':103C 'build':36B 'code':66B 'concaten':94C 'contain':79C 'control':1A,19B,28B,71C 'control-web-panel':18B 'cve':12A,15A 'cwp':22B,31B,74C 'direct':95C 'directori':53B,111C 'execut':67B 'file':11A,61B,123C,128C 'host':27B 'includ':8A,38B,57B,98C,119C 'inclus':129C 'lead':64B 'let':6A 'local':59B,121C,126C 'modul':45B,91C,116C 'name':46B,92C,117C 'panel':3A,21B,30B,73C 'path':4A,39B,81C,99C 'php':10A,23B,60B,122C,127C 'result':124C 'runtim':24B 'sanit':48B,106C 'self':26B 'self-host':25B 'sequenc':55B,113C 'server':70B 'services/users/index.php':85C 'suppli':44B,90C,110C 'travers':5A,54B,82C,105C,112C 'use':52B 'version':34B,77C 'vulner':83C 'web':2A,20B,29B,72C 'webpanel':33B,76C 'without':47B","nicknames":[],"mitigations":[],"who_affected":"Servers running Control Web Panel (CWP) before webpanel_version 1.16 are exposed, since the flaw is in services/users/index.php. Hosts already on 1.16 or later, or not running CWP, can skip it. Whether unauthenticated requests reach the vulnerable file is not stated in the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","critical","cwp","php","runtime","selfhosted"],"first_public_at":"2026-11-02T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73695","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73695","severity":null,"published_at":"2026-11-02T15:17:37+00:00","modified_at":"2026-11-02T15:17:37+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52540,"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}