CVE-2026-73695: Path Traversal and RCE in Control Web Panel

CVE-2026-73695: Path traversal and RCE in CWP before 1.16. Affects user management panels. Urgent update required.

CVE-2026-73695 is a path traversal vulnerability in the services/users/index.php file of Control Web Panel (CWP) versions before 1.16. An unsanitized module name parameter is concatenated directly into an include path, allowing an attacker to inject directory traversal sequences (such as ../) to include arbitrary PHP files from the server and achieve code execution within the user panel context. The impact is severe: the control panel remains fully compromised.

The vulnerability was registered on NVD on November 2, 2026. The CVSS score is 8.8 (High), consistent with remote code execution capability in the management system. X shows 5 posts in the last 24 hours regarding CVE-2026-73695 and related CWP vulnerabilities, with minimal engagement (4 total interactions): a signal of sector awareness. No confirmed public exploits are reported in available data.

In defense: identify all systems running Control Web Panel and verify their version. If below 1.16, update immediately. Examine user panel and web server logs for traversal sequences in parameters, especially in services/users/index.php. Monitor panel requests for anomalies after patching.

At a glance

What: Path traversal in services/users/index.php of the CWP control panel. An unsanitized module name parameter is concatenated directly into an include path, allowing inclusion of arbitrary PHP files and code execution within the user panel context.
Severity: CVSS 8.8 (High). The vulnerability enables arbitrary PHP execution in the user panel context, granting complete access and control over the management system.
Affected versions: Control Web Panel (CWP) before version 1.16.
Fix: Update to Control Web Panel version 1.16 or later to resolve the path traversal vulnerability in services/users/index.php.
Status: Vulnerability published to NVD on November 2, 2026. Active discussion signals on X (5 posts in the last 24 hours). No confirmed public exploit in available data.
Action: Identify CWP instances in use and verify their version. Update immediately to version 1.16 or later. Review user panel and web server logs for traversal sequences in parameters.

Sources: NVD, CVE-2026-73695

← All articles