Vulnerability · Published Nov 2, 2026 · Assigned by VulnCheck

CVE-2026-73697Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor

High 8.8

In plain English

A high-severity OS command injection in Control Web Panel from Control Web Panel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.8%top 21.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.

Affected products (as reported)

Vendor	Product	Versions
Control Web Panel	Control Web Panel	0 – before 1.16

Weakness: CWE-78, CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Changelog release-notes, patch
VulnCheck Blog technical-description, exploit
VulnCheck Advisory: Control Web Panel (CWP) < 1.16 File Write and Command Injection third-party-advisory