AI description
CVE-2026-73696 is an execution-after-redirect vulnerability (CWE-698) affecting Control Web Panel (CWP) versions prior to 1.12. The flaw resides in the user panel's authentication flow within `CWPUserIndex`. When an unauthenticated user attempts to access the panel, the system issues a redirect header to send them to the login page. However, because the code lacks a subsequent `exit()` command, the PHP script continues executing in the background. This allows unauthenticated requests to bypass the intended login wall and reach the module dispatcher and other user-panel functionalities. While the vulnerability does not grant direct code execution on its own, it allows attackers to access internal user-panel code paths. This access can be chained with other vulnerabilities, such as directory traversal flaws, to potentially achieve remote code execution or root access on the hosting server. Discovered by security researcher Valentin Lobstein, the issue was addressed by the vendor, and users are advised to update Control Web Panel to version 1.12 or later to resolve the flaw.
- Description
- Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
- Source
- disclosure@vulncheck.com
- NVD status
- Deferred
CVSS 4.0
- Type
- Secondary
- Base score
- 8.6
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- HIGH
CVSS 3.1
- Type
- Primary
- Base score
- 8.1
- Impact score
- 5.2
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity
- HIGH
- disclosure@vulncheck.com
- CWE-698
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
2
👉 CWP2Shell (Control Web Panel) ● CVE-2026-73695: Kimlik doğrulaması olmadan dosya dahil etme (LFI). ● CVE-2026-73696: Yönlendirme sonrasında yetkilendirme akışının devam etmesi. ● CVE-2026-73697: Dosya yazma ve komut enjeksiyonu. ● CVE-2026-77876: Kritik işl
@ridvanyagli
4 Nov 2026
732 Impressions
0 Retweets
9 Likes
2 Bookmarks
1 Reply
0 Quotes
👉 CWP2Shell (Control Web Panel) ● CVE-2026-73695: Kimlik doğrulaması olmadan dosya dahil etme (LFI). ● CVE-2026-73696: Yönlendirme sonrasında yetkilendirme akışının devam etmesi. ● CVE-2026-73697: Dosya yazma ve komut enjeksiyonu. ● CVE-2026-77876: Kritik işl
@ridvanyagli
4 Nov 2026
29 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Today, @VulnCheckAI disclosed an unauthenticated remote root RCE chain in Control Web Panel. CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, CVE-2026-77876, CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-77881, CVE-2026-104080. https://t.co/GIct4zBfjM
@Chocapikk_
3 Nov 2026
2598 Impressions
3 Retweets
38 Likes
13 Bookmarks
0 Replies
0 Quotes
🔐Control Web Panel: 3 CVSS 9.8 flaws, one day. CVE-2026-73695 — path traversal → LFI CVE-2026-73696 — auth bypass (no password, just a username) CVE-2026-73697 — file write + shell_exec in phpini_editor Patch to CWP 1.16. https://t.co/r7eriW2Hml #CyberSecurity #CVE
@ThreatAft
3 Nov 2026
93 Impressions
1 Retweet
2 Likes
0 Bookmarks
0 Replies
0 Quotes
🚨 Control Web Panel (CWP) için 3 kritik güvenlik açığı yayınlandı! 🔴 CVE-2026-73695 — Path Traversal / LFI 🔴 CVE-2026-73696 — Kimlik doğrulama akışıyla ilişkili açık 🔴 CVE-2026-73697 — Arbitrary File Write / OS Command Injection Bu açıklar CWP
@ridvanyagli
2 Nov 2026
1168 Impressions
3 Retweets
17 Likes
5 Bookmarks
1 Reply
1 Quote