CVE-2026-73697

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-73697
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://control-webpanel.com/changelog
https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection-via-phpini-editor
https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce
Configurations

No configuration.

History

03 Nov 2026, 14:17

Type Values Removed Values Added
References
  • () https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce -

02 Nov 2026, 16:17

Type Values Removed Values Added
Summary (en) Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution. (en) Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.
CVSS v2 : unknown
v3 : 9.8 		v2 : unknown
v3 : 8.8
References
  • {'url': 'https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection', 'source': 'disclosure@vulncheck.com'}
  • () https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection-via-phpini-editor -

02 Nov 2026, 15:17

Type Values Removed Values Added
New CVE
Information

Published : 2026-11-02 15:17

Updated : 2026-11-03 14:17

NVD link : CVE-2026-73697

Mitre link : CVE-2026-73697

CVE.ORG link : CVE-2026-73697

JSON object : View

Products Affected

No product.

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')