CVE-2026-73697
Received Received - Intake

Arbitrary File Write and OS Command Injection in Control Web Panel

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: VulnCheck

Description
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-73697

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Control Web Panel Control Web Panel 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Control Web Panel (CWP) before version 1.16 has a vulnerability in the phpini_editor module that allows arbitrary file writes and OS command injection. The acc=update action lets attackers write files to any path without restrictions, and the acc=addlabelphpiniadv action executes unsanitized input via shell_exec. This combination enables remote code execution.

Detection Guidance

Check for the presence of Control Web Panel (CWP) versions before 1.16. Inspect the phpini_editor module for suspicious file writes or command execution attempts in logs. Look for unauthorized modifications to system files or unexpected processes spawned from the web panel.

Impact Analysis

An attacker with access to the vulnerable module could write malicious files to the server or execute arbitrary commands. This could lead to full system compromise, data theft, or further network infiltration. The impact includes unauthorized access, data breaches, and potential service disruption.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage due to breaches of confidentiality and integrity.

Mitigation Strategies

Upgrade Control Web Panel to version 1.16 or later immediately. Disable the phpini_editor module if not required. Restrict access to the module via firewall rules or authentication controls. Monitor for signs of exploitation such as unexpected file writes or command execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73697. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...