Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-73695— Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

Quick assessment

Affected
Control Web Panel Control Web Panel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Control Web Panel (CWP) 在 webpanel_version 1.16 之前的版本中，其 文件存在路径遍历漏洞。该漏洞源于将攻击者提供的模块名称直接拼接到包含路径中，且未实施任何白名单校验、 函数处理或路径遍历清理措施。攻击者可在模块名称中注入目录遍历序列，从而包含任意本地 文件，导致本地 PHP 文件包含漏洞。

CVSS 8.8 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-73695

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
Source: CVE Program / CVE List V5
Vulnerability Description
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
PHP程序中Include/Require语句包含文件控制不恰当(PHP远程文件包含)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Control Web Panel Control Web Panel 0 ~ 1.16 -

II. Public POCs for CVE-2026-73695

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-73695

请登录查看更多情报信息。

Other References for CVE-2026-73695 (3)

Same Patch Batch · Control Web Panel · 2026-11-02 · 10 CVEs total

CVE-2026-77876 9.8 CRITICAL Control Web Panel (CWP) < 1.16 OS Command Injection via protected_directory
CVE-2026-73696 9.1 CRITICAL Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
CVE-2026-73697 8.8 HIGH Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
CVE-2026-77880 8.4 HIGH Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
CVE-2026-77878 8.4 HIGH Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API
CVE-2026-77877 8.4 HIGH Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access
CVE-2026-104080 8.4 HIGH Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token
CVE-2026-77879 7.7 HIGH Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API
CVE-2026-77881 6.2 MEDIUM Control Web Panel (CWP) < 1.30 Blind SQL Injection via user Parameter

IV. Related Vulnerabilities

Same product: Control Web Panel
Same vendor: Control Web Panel
Same weakness: CWE-98