Control Web Panel: Path traversal local file inclusion (CVE-2026-73695)
Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files.
CVE search metadata
CVE search record: CVE-2026-73695. Severity: critical. CVSS: 9.8. KEV: no. Product: Control Web Panel (< 1.16). Brief: Control Web Panel: Path traversal local file inclusion (CVE-2026-73695). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cwp-lfi/
Triage facts
Revision 1- Applicability
- Control Web Panel (< 1.16)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 21:51 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php. By supplying an unsanitized module name parameter, which is concatenated into an include path, attackers can use directory traversal sequences to include arbitrary local PHP files and execute arbitrary PHP code in the user panel context.