CVE-2026-73695High· 8.8▾ TwilightControl Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concate…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
1.0%
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
control_web_panel < 1.16Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-73697High· 8.8Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
CVE-2026-104080High· 7.8Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token
CVE-2026-77881Medium· 5.5Control Web Panel (CWP) < 1.29 Blind SQL Injection via user Parameter
CVE-2026-77880High· 7.8Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
CVE-2026-77879High· 7.1Control Web Panel (CWP) < 1.16 SQL Injection via access_token() API
CVE-2026-77877High· 7.8Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access