AI description
CVE-2026-73695 is a path traversal vulnerability affecting Control Web Panel (CWP) versions prior to webpanel_version 1.16. The flaw resides in the `services/users/index.php` file, where an attacker-supplied module name is concatenated directly into an include path without proper sanitization, such as an allowlist, `basename()`, or traversal checks. By injecting directory traversal sequences into the module name parameter, an attacker can achieve local file inclusion (LFI). This allows the inclusion of arbitrary local PHP files on the server, which can lead to the execution of arbitrary PHP code within the user panel context. The vulnerability is remotely exploitable over the network, requiring low-privilege access and no user interaction.
- Description
- Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
- Source
- disclosure@vulncheck.com
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 8.7
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
CVSS 3.1
- Type
- Secondary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- disclosure@vulncheck.com
- CWE-98
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
2
👉 CWP2Shell (Control Web Panel) ● CVE-2026-73695: Kimlik doğrulaması olmadan dosya dahil etme (LFI). ● CVE-2026-73696: Yönlendirme sonrasında yetkilendirme akışının devam etmesi. ● CVE-2026-73697: Dosya yazma ve komut enjeksiyonu. ● CVE-2026-77876: Kritik işl
@ridvanyagli
4 Nov 2026
732 Impressions
0 Retweets
9 Likes
2 Bookmarks
1 Reply
0 Quotes
👉 CWP2Shell (Control Web Panel) ● CVE-2026-73695: Kimlik doğrulaması olmadan dosya dahil etme (LFI). ● CVE-2026-73696: Yönlendirme sonrasında yetkilendirme akışının devam etmesi. ● CVE-2026-73697: Dosya yazma ve komut enjeksiyonu. ● CVE-2026-77876: Kritik işl
@ridvanyagli
4 Nov 2026
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Today, @VulnCheckAI disclosed an unauthenticated remote root RCE chain in Control Web Panel. CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080. https://t.co/GIct4zBfjM
@Chocapikk_
3 Nov 2026
2598 Impressions
3 Retweets
38 Likes
13 Bookmarks
0 Replies
0 Quotes
🔐Control Web Panel: 3 CVSS 9.8 flaws, one day. CVE-2026-73695 — path traversal → LFI CVE-2026-73696 — auth bypass (no password, just a username) CVE-2026-73697 — file write + shell_exec in phpini_editor Patch to CWP 1.16. https://t.co/r7eriW2Hml #CyberSecurity #CVE
@ThreatAft
3 Nov 2026
93 Impressions
1 Retweet
2 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Control Web Panel (CWP) için 3 kritik güvenlik açığı yayınlandı! 🔴 CVE-2026-73695 — Path Traversal / LFI 🔴 CVE-2026-73696 — Kimlik doğrulama akışıyla ilişkili açık 🔴 CVE-2026-73697 — Arbitrary File Write / OS Command Injection Bu açıklar CWP
@ridvanyagli
2 Nov 2026
1168 Impressions
3 Retweets
17 Likes
5 Bookmarks
1 Reply
1 Quote