CVE-2026-73695: Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

Q: What level of access does an attacker need?

The CVSS vector indicates low privileges are required. No user interaction is required, and the attack can be performed over the network.

Q: Which installations are affected?

Control Web Panel installations with a webpanel_version earlier than 1.16 are affected. Systems running version 1.16 or later are not identified as affected by this issue.

Q: What is the impact of successful exploitation?

An attacker can supply directory-traversal sequences through the module name parameter to include arbitrary local PHP files. This can result in execution of arbitrary PHP code in the user panel context.

Published Nov 2, 2026

Updated

Control Web Panel (CWP) before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Control Web Panel (CWP) to a version that resolves this vulnerability.
Fixed in 1.16

Event History

Nov 2, 2026

CVE Published

via MITRE·02:51 PM

Data Sourced

via MITRE·02:51 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The CVSS vector indicates low privileges are required. No user interaction is required, and the attack can be performed over the network.

Which installations are affected?

Control Web Panel installations with a webpanel_version earlier than 1.16 are affected. Systems running version 1.16 or later are not identified as affected by this issue.

What is the impact of successful exploitation?

An attacker can supply directory-traversal sequences through the module name parameter to include arbitrary local PHP files. This can result in execution of arbitrary PHP code in the user panel context.

CVE-2026-73695: Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

Which installations are affected?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

Which installations are affected?

What is the impact of successful exploitation?