CVE-2026-73695
HighCVSS 8.8Summary
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php. An unsanitized module name parameter is concatenated directly into an include path, allowing local file inclusion and execution of arbitrary PHP code in the user panel context.
Risk Assessment
An attacker can include and execute any local PHP file, leading to code execution in the user panel context. This may result in session compromise or further privilege escalation.
Recommendation
Update CWP to version 1.16 or later. Verify that the module name parameter is properly validated and review logs for path traversal attempts.
Other vulnerabilities in Control Web Panel
See all- CVE-2026-77881Medium
Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root. The 'user' parameter is interpolated directly into a query against the oauth_clients table, enabling time-based blind SQL injection and extraction of arbitrary database contents.
- CVE-2026-77880High
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter passed unescaped into a shell command.
- CVE-2026-77879High
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters.
- CVE-2026-77878High
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping.
- CVE-2026-77877High
Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/.
- CVE-2026-104080High
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route. Unauthenticated attackers can execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter, which is passed unescaped into a shell_exec() call.
- CVE-2026-73697High
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes files via file_put_contents without path confinement, and acc=addlabelphpiniadv passes unsanitized input into shell_exec, achieving code execution in the user panel context.
- CVE-2026-57517Critical
Control Web Panel before version 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated remote attackers to execute arbitrary SQL queries by submitting unsanitized input through the userRes POST parameter at the user endpoint. Attackers can exploit MySQL root privileges obtained via the injection to write arbitrary files using INTO DUMPFILE, enabling deployment of a PHP webshell to the web-accessible roundcube logs directory and achieving remote code execution as the cwpsvc account.
- CVE-2025-48703CriticalActively exploited
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
- CVE-2022-44877CriticalActively exploited
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Original NVD description (English source)
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS