Arbitrary File Write and OS Command Injection in Control Web Panel by Control Web Panel, Inc.

CVE-2026-73697

What is CVE-2026-73697?

The Control Web Panel (CWP) prior to version 1.16 is susceptible to significant security vulnerabilities that allow attackers to exploit the phpini_editor user panel module. Through the 'acc=update' action, an attacker can write files to insecure paths using the file_put_contents function without adequate path confinement. Additionally, the 'acc=addlabelphpiniadv' action passes unfiltered attacker input to the shell_exec function, which could lead to the execution of arbitrary operating system commands. These vulnerabilities provide a pathway for remote code execution, potentially compromising the entire system.

References