{"id":"CVE-2026-73697","kind":"vulnerability","aliases":["CVE-2026-73697"],"related":[],"title":"Control Web Panel: file write and OS command injection enable remote code execution","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.","summary":"Control Web Panel (CWP) before version 1.16 lets a user of the phpini_editor module write arbitrary files to any path and run arbitrary operating system commands. An attacker who can reach that module gets remote code execution on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["control-web-panel","linux-hosting","other","self-hosted"],"not_affected_if":["no-untrusted-panel-users","webpanel_version-1.16-or-later"],"how_to_check":"- Check the installed CWP version (webpanel_version) and confirm whether it is below `1.16`\n- Look for the phpini_editor user panel module in the CWP installation","fix":"- Move CWP to `1.16` or later (webpanel_version)","status":"open","published_at":"2026-11-02T15:17:37+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","triaged_at":"2026-11-02T15:25:40+00:00","updated_at":"2026-11-02T15:25:40+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-02T15:25:40Z","model":"claude-haiku-5-5","output":{"fix":"- Move CWP to `1.16` or later (webpanel_version)","reach":"unknown","title":"Control Web Panel: file write and OS command injection enable remote code execution","impact":"high","summary":"Control Web Panel (CWP) before version 1.16 lets a user of the phpini_editor module write arbitrary files to any path and run arbitrary operating system commands. An attacker who can reach that module gets remote code execution on the server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["control-web-panel","self-hosted","linux-hosting"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary OS commands and writes files on the server","analyst_note":"Confirm whether the phpini_editor module is exposed to any non-admin user by default; read the vendor advisory at www.vulncheck.com for affected ranges.","how_to_check":"- Check the installed CWP version (webpanel_version) and confirm whether it is below `1.16`\n- Look for the phpini_editor user panel module in the CWP installation\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["webpanel_version-1.16-or-later","no-untrusted-panel-users"],"who_is_affected":"Servers running Control Web Panel before webpanel_version 1.16 with the phpini_editor module reachable by users. The flaw is in the user panel, so exposure depends on whether untrusted or low-privilege accounts can reach that module. unknown whether default configurations expose it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000711,"input_tokens":4226,"output_tokens":577,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-73697':16A,19A '1.16':37B,79C 'acc':98C,122C 'access':137C 'action':100C,124C 'addlabelphpiniadv':123C 'arbitrari':47B,54B,82C,143C,147C 'attack':59B,103C,109C,127C,135C 'attacker-control':102C 'attacker-suppli':108C 'code':12A,67B,153C 'command':8A,57B,87C,149C 'confin':119C 'contain':80C 'content':105C,115C 'control':1A,21B,31B,72C,104C 'control-web-panel':20B 'cve':14A,17A 'cwp':34B,75C 'editor':44B,93C 'enabl':10A 'escap':133C 'exec':131C 'execut':13A,68B,146C,154C 'file':4A,48B,83C,113C,144C 'get':65B 'host':26B,30B 'inject':9A,88C 'input':128C 'let':38B 'linux':25B 'linux-host':24B 'modul':45B,64B,96C,140C 'oper':55B 'os':7A,86C,148C 'panel':3A,23B,33B,74C,95C 'pass':125C 'path':51B,111C,118C 'phpini':43B,92C 'put':114C 'reach':62B 'remot':11A,66B,152C 'result':150C 'run':53B 'self':29B 'self-host':28B 'server':71B 'shell':130C 'suppli':110C 'system':56B 'unsanit':126C 'updat':99C 'user':40B,94C 'version':36B,78C 'via':112C 'vulner':89C 'web':2A,22B,32B,73C 'webpanel':77C 'without':132C 'write':5A,46B,84C,101C,142C","nicknames":[],"mitigations":[],"who_affected":"Servers running Control Web Panel before webpanel_version 1.16 with the phpini_editor module reachable by users. The flaw is in the user panel, so exposure depends on whether untrusted or low-privilege accounts can reach that module. unknown whether default configurations expose it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["controlwebpanel","critical","linuxhosting","other","selfhosted"],"first_public_at":"2026-11-02T15:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-73697","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73697","severity":null,"published_at":"2026-11-02T15:17:37+00:00","modified_at":"2026-11-02T15:17:37+00:00","first_seen_at":"2026-11-02T15:24:04+00:00","fetched_at":"2026-11-02T15:24:04+00:00","note":null}],"documents":[{"id":52544,"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}