home / blog
2026-11-03 · high
CVE-2026-73697: Arbitrary File Write and RCE in CWP
Arbitrary file write and RCE in CWP before 1.16. CVSS 8.8. Requires access to phpini_editor module.
Control Web Panel (CWP) versions before 1.16 contain arbitrary file write and OS command injection vulnerabilities in the phpini_editor module of the user panel, identified as CVE-2026-73697. The vulnerability directly impacts hosting providers, server administrators, and infrastructure managers who rely on CWP for remote administration.
The vulnerability has a CVSS score of 8.8 (HIGH). NVD published it on November 2, 2026. Social media signals show consistent alerts regarding CVE-2026-73697 and related CWP vulnerabilities. Active exploitation in the wild is not confirmed at this time.
Administrators and sysadmins must update CWP to version 1.16 or later immediately. In the interim, review access logs for the phpini_editor module to detect anomalous activity, restrict module access to trusted users only, and monitor system directories for unexpected file creations that may indicate compromise.
At a glance
- What
- Control Web Panel (CWP), server and hosting administration software, contains arbitrary file write and OS command injection vulnerabilities in the phpini_editor module of the user panel. Identified as CVE-2026-73697.
- Severity
- CVSS 8.8 (HIGH). The vulnerability allows authenticated users with access to the module to write arbitrary files to unconfined paths and execute arbitrary OS commands in the user panel context.
- Affected versions
- CWP before version 1.16
- Fix
- Update to Control Web Panel version 1.16 or later
- Status
- Published by NVD on November 2, 2026. Social media signals report CVE-2026-73697 consistently alongside other CWP vulnerabilities. Active exploitation in the wild is not confirmed.
- Action
- Hosting administrators and sysadmins must update CWP to version 1.16 minimum immediately. Review access logs for the phpini_editor module to detect anomalous activity. Restrict module access to trusted users only.
Sources: NVD, CVE-2026-73697