CVE-2026-73695
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in…
- Risk score
- 63/100
- CVSS
- 8.8 v3.1
- Published
- 2 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php, allowing an attacker to include arbitrary local .php files. This could lead to local PHP file inclusion.
- Affected
- {'products': ['Control Web Panel (CWP)'], 'packages': [], 'versions': ['before webpanel_version 1.16']}
- Fix
- Check the linked advisory for a fix, as none is specified.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
- On your watchlist: php
References
Original description
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
Last activity 2 Nov 2026. Patch Forecast updates every hour.