---
id: CVE-2026-73695
title: Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
summary: >-
  Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal
  vulnerability in services/users/index.php that allows attackers to include
  arbitrary local PHP files by supplying an unsanitized module name parameter
  concate…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-98
vendor: Control Web Panel
product: Control Web Panel
affected:
  - control_web_panel < 1.16
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T17:00:18.033Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-73695'
references:
  - url: 'https://control-webpanel.com/changelog'
    label: Changelog
  - url: >-
      https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce
    label: VulnCheck Blog
  - url: >-
      https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php
    label: >-
      VulnCheck Advisory: Control Web Panel (CWP) < 1.16 Path Traversal LFI via
      module Parameter
tags:
  - cve.org
epss: 0.00952
epssPercentile: 0.61527
ingestedAt: '2026-11-05T20:33:06.296Z'
---

## Overview

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

## Affected

- `control_web_panel < 1.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.