Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-73695Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

High 8.8

In plain English

A high-severity security flaw in Control Web Panel from Control Web Panel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.0%top 38.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

Affected products (as reported)

Vendor	Product	Versions
Control Web Panel	Control Web Panel	0 – before 1.16

Weakness: CWE-98 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Changelog release-notes, patch
VulnCheck Blog technical-description, exploit
VulnCheck Advisory: Control Web Panel (CWP) < 1.16 Path Traversal LFI via module Parameter third-party-advisory