Read the docs
TI-2026-83859 Aliases CVE-2026-73695GHSA-m2m4-55x5-x967

Path traversal in Control Web Panel enables local file inclusion

Priority LOW 39CWE-98Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-98.

Summary

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal flaw in services/users/index.php. The module name parameter is concatenated into an include path without sanitization (CWE-98), so a remote attacker with low privileges can include arbitrary local PHP files. This lets the attacker execute arbitrary PHP code in the user panel context.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

Why it matters now

EPSS 0.00952 61st percentileScored 2026-11-07
Fix Fixed Control Web Panel (Control Web Panel): 1.16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Control Web PanelControl Web Panelbefore 1.161.16Patch availableCNA
  • Control Web Panel VendorControl Web Panel Affected before 1.16 Fixed in 1.16 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*——Control Web Panel
  • cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:* Versions — — ·Control Web Panel

Remediation

Update Control Web Panel to version 1.16 or later, which fixes this flaw in the affected range before 1.16.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Control Web Panel (Control Web Panel) Fixed in 1.16

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Control Web Panel 1.16

    5 records Highest priority Priority HIGH 1 HIGH, 2 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-83868 SQL injection in Control Web Panel access_token() APIPriority HIGH 72
    • TI-2026-83861 File write and command injection in Control Web Panel phpini_editorPriority MEDIUM 43
    • TI-2026-83865 OS command injection in Control Web Panel protected_directory modulePriority MEDIUM 42
    Show all 5 records →

Timeline

  1. 2026-11-02 Threatist record created from CVE-2026-73695
  2. 2026-11-02 Title updated · CNA
  3. 2026-11-02 CVSS score changed · CNA
  4. 2026-11-02 Alias added: GHSA-m2m4-55x5-x967
  5. 2026-11-04 Priority changed: MEDIUM → LOW

References

Patch 1

  • TI-2022-22082 login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147… KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-30935 OS command injection in CentOS Web Panel KEVCVSS 3.1CRITICAL 9.0
  • TI-2021-20554 In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated… CVSS 3.1CRITICAL 9.8
  • TI-2021-20553 In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make… CVSS 3.1CRITICAL 9.8
  • TI-2026-41408 Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter CVSS 4.0CRITICAL 9.3
  • TI-2022-08811 A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to… CVSS 3.1CRITICAL 9.8
See all 95 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences