Control Web Panel (< 1.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/control-web-panel--1.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 02 Nov 2026 21:51:12 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgControl Web Panel: Path traversal local file inclusion (CVE-2026-73695)https://feed.craftedsignal.io/briefs/2026-11-cwp-lfi/Mon, 02 Nov 2026 21:51:12 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cwp-lfi/Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files.<p>Control Web Panel (CWP) before version 1.16 contains a path traversal vulnerability in services/users/index.php. By supplying an unsanitized module name parameter, which is concatenated into an include path, attackers can use directory traversal sequences to include arbitrary local PHP files and execute arbitrary PHP code in the user panel context.</p> highadvisory