CVE-2026-736958.8High
CVE-2026-73695: Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
Vendor fix available · Affected: Control Web Panel · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.04 (4 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
0.9%probability of exploitation in the next 30 days
61st percentile
050100
Higher than 61% of scored CVEs
8.8HighCVSS
LowMediumHighCrit.
DescriptionNVD
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 5 Nov.
- Control Web Panel flaws chain to unauthenticated root accessSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.