CVE-2026-73697

Published Nov 2, 2026

Last updated 2 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-73697 is an arbitrary file write and OS command injection vulnerability affecting Control Web Panel (CWP) versions prior to 1.16. The flaw resides within the `phpini_editor` user panel module. An attacker who has access to this module can exploit the vulnerability to write attacker-controlled content to arbitrary paths and execute arbitrary operating system commands, ultimately leading to remote code execution in the context of the user panel. The vulnerability stems from two specific actions within the module. First, the `acc=update` action utilizes the `file_put_contents` function without path confinement, allowing attackers to write files to any directory. Second, the `acc=addlabelphpiniadv` action passes unsanitized user input directly into the `shell_exec` function without proper escaping. To address this issue, users are advised to update Control Web Panel to version 1.16 or later.

Description: Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.
Source: disclosure@vulncheck.com
NVD status: Deferred

Risk scores

CVSS 4.0

Type: Secondary
Base score: 8.7
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

disclosure@vulncheck.com: CWE-22

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 2

References

Sources include official advisories and independent security research.