CVE-2026-73697: Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor

Control Web Panel (CWP) before webpanelversion 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpinieditor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via fileputcontents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shellexec, achieving code execution in the user panel context.