CVE-2026-73695

🚨 Control Web Panel (CWP) için 3 kritik güvenlik açığı yayınlandı! 🔴 CVE-2026-73695 — Path Traversal / LFI 🔴 CVE-2026-73696 — Kimlik doğrulama akışıyla ilişkili açık 🔴 CVE-2026-73697 — Arbitrary File Write / OS Command Injection Bu açıklar CWP 1.16.2 sürüm ve öncesini etkiliyor. Özellikle dosya yazma ve komut enjeksiyonu açıkları, koşullara bağlı olarak sunucuda kod çalıştırılmasına yol açabilir. CWP 1.29 sürüm notlarında çeşitli güvenlik iyileştirmeleri bulunuyor. CWP kullanan hosting yöneticileri, etkilenen sürümleri ve yama durumunu kontrol etmeli ve mutlaka en kısa sürede son sürüme güncellemeli. 🔗 https://forum.centos-webpanel.com/updates/cwp-new-version-released-1-29-changelog

🔴 3 critical CVEs in Control Web Panel Worst: local file inclusion via hosting panel module parameter (CVE-2026-73695) Patch → see advisories https://cve.now/CVE-2026-73695?release=CVE-2026-73696,CVE-2026-73697&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup

🔐Control Web Panel: 3 CVSS 9.8 flaws, one day. CVE-2026-73695 — path traversal → LFI CVE-2026-73696 — auth bypass (no password, just a username) CVE-2026-73697 — file write + shell_exec in phpini_editor Patch to CWP 1.16. https://threataft.com/articles/control-web-panel-cve-2026-73695-73696-73697 #CyberSecurity #CVE #Infosec

@cvedotnow https://threataft.com/articles/control-web-panel-cve-2026-73695-73696-73697

Control Web Panel (CWP) Two Auth Bypass and File Inclusion Flaws (CVE-2026-73695, 73696): Update Anything Before 1.16 CWP before 1.16 has an unauthenticated local file inclusion and an authentication bypass… https://smartscope.blog/en/blog/control-web-panel-cwp-cve-2026-73695-73696-auth-bypass-file-inclusion-update-2026/?s=x

@TheHackerWire https://threataft.com/articles/control-web-panel-cve-2026-73695-73696-73697

@ridvanyagli https://threataft.com/articles/control-web-panel-cve-2026-73695-73696-73697

@PNovavisio32590 https://threataft.com/articles/control-web-panel-cve-2026-73695-73696-73697

🔢 The vendor changelog lists 1.12 on 8 September, then 1.26 on 26 October. 48 days (derived), no 1.16, and no CVE named. The three records say "before 1.12" for one flaw and "before 1.16" for two. They call the number "webpanel_version". Whether that is the number a server shows is not stated. ⚠️ The headline is shakier than it looks. GitHub's text says a valid hosting username is enough and that a chain leads to root, with 9.8 on all three. The CVE records, NVD and VulnCheck say neither, and score two of them 8.8 High. 🔁 The bug class is old: a redirect header sent without exit(), so the browser leaves but the server keeps running the code behind the login. ❌ Not stated: which modules an anonymous caller reaches, any chain, exposure counts, use in the wild. CISA's data says Exploitation none. 📌 On 1.12 to 1.15, two of the three records still apply. 🔗 https://www.pk-sharma.com/briefing/control-web-panel-cve-2026-73695-73696-73697-fixed-1-12-and-1-16-changelog-lists-no-1-16 #ControlWebPanel #CWP #WebHosting #CVE #PHP #VulnerabilityManagement #PatchManagement #VulnCheck #AuthenticationBypass #SharedHosting #Linux #CyberSecurity #InfoSec #ThreatIntelligence