---
id: "CVE-2026-73695"
kind: "vulnerability"
aliases: ["CVE-2026-73695"]
title: "Control Web Panel: path traversal lets attackers include arbitrary PHP files"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["control-web-panel", "cwp", "php", "runtime", "self-hosted"]
not_affected_if: ["webpanel-1.16-or-later"]
published_at: "2026-11-02T15:17:37+00:00"
first_seen_at: "2026-11-02T15:24:04+00:00"
updated_at: "2026-11-02T15:25:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73695", "first_seen_at": "2026-11-02T15:24:04+00:00"}]
---

# Control Web Panel: path traversal lets attackers include arbitrary PHP files

Control Web Panel (CWP) before webpanel_version 1.16 builds an include path from an attacker-supplied module name without sanitization. An attacker can use directory traversal sequences to include arbitrary local PHP files, which can lead to code execution on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CWP webpanel version and confirm whether it is below `1.16`.
- Review `services/users/index.php` in the CWP installation for the unsanitized module name include.

## Fix

- Move CWP to `1.16` or later, as stated in the advisory description.

## Timeline

- 2026-11-02T15:24:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-73695

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter

## From the sources

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_