Path Traversal Vulnerability in Control Web Panel by Control Web Panel
CVE-2026-73695

8.7HIGH

Key Information:

Vendor

Control Web Panel

Status
Control Web Panel
Vendor
CVE Published:
2 November 2026

What is CVE-2026-73695?

Control Web Panel (CWP) versions before 1.16 are exposed to a path traversal vulnerability that allows attackers to include arbitrary local PHP files. This is due to an insufficient sanitization mechanism where user-supplied module names are directly concatenated in the include path. Attackers can exploit this flaw by injecting directory traversal sequences, potentially leading to unauthorized access of sensitive files on the server. It is crucial for users of CWP to upgrade to version 1.16 or later to mitigate this security risk.

Affected Version(s)

Control Web Panel 0 < 1.16

References

https://control-webpanel.com/changelog
release-notespatch
https://www.vulncheck.com/advisories/control-web-panel-cw...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.