CVE-2026-73695

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-73695
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://control-webpanel.com/changelog
https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php
https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce
Configurations

No configuration.

History

03 Nov 2026, 14:17

Type Values Removed Values Added
References
  • () https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce -

02 Nov 2026, 16:17

Type Values Removed Values Added
Summary (en) Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion. (en) Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
References
  • {'url': 'https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter', 'source': 'disclosure@vulncheck.com'}
  • () https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php -
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.8

02 Nov 2026, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-11-02 15:17

Updated : 2026-11-03 14:17

NVD link : CVE-2026-73695

Mitre link : CVE-2026-73695

CVE.ORG link : CVE-2026-73695

JSON object : View

Products Affected

No product.

CWE
CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')