Live › vulnerability › CVE-2026-73697
Control Web Panel (CWP) before version 1.16 lets a user of the phpini_editor module write arbitrary files to any path and run arbitrary operating system commands. An attacker who can reach that module gets remote code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 15:24 UTC. All times on this page are UTC.
Servers running Control Web Panel before webpanel_version 1.16 with the phpini_editor module reachable by users. The flaw is in the user panel, so exposure depends on whether untrusted or low-privilege accounts can reach that module. unknown whether default configurations expose it.
No product ranges from the sources yet.
1.161.16 or later (webpanel_version)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-73697")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.