VulnSocial

CVE-2026-73697

LOWCVSS 8.7 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-22CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 3 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Peaked 1d ago at 2 mentions (2026-11-02); latest day: 1
  • 3 total mentions across 2 days

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-11-02: 2Mentions · 2026-11-03: 111-0211-03
Referenced assets3 URLs
Full discourse3 posts
  • Rıdvan Yağlı@ridvanyagli

    🚨 Control Web Panel (CWP) için 3 kritik güvenlik açığı yayınlandı! 🔴 CVE-2026-73695 — Path Traversal / LFI 🔴 CVE-2026-73696 — Kimlik doğrulama akışıyla ilişkili açık 🔴 CVE-2026-73697 — Arbitrary File Write / OS Command Injection Bu açıklar CWP 1.16.2 sürüm ve öncesini etkiliyor. Özellikle dosya yazma ve komut enjeksiyonu açıkları, koşullara bağlı olarak sunucuda kod çalıştırılmasına yol açabilir. CWP 1.29 sürüm notlarında çeşitli güvenlik iyileştirmeleri bulunuyor. CWP kullanan hosting yöneticileri, etkilenen sürümleri ve yama durumunu kontrol etmeli ve mutlaka en kısa sürede son sürüme güncellemeli. 🔗 https://forum.centos-webpanel.com/updates/cwp-new-version-released-1-29-changelog

    1311851.4K
    3.1K followersView on X
  • cve.now@cvedotnow

    🔴 3 critical CVEs in Control Web Panel Worst: local file inclusion via hosting panel module parameter (CVE-2026-73695) Patch → see advisories https://cve.now/CVE-2026-73695?release=CVE-2026-73696,CVE-2026-73697&utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=rollup

    210211.0K
    21.4K followersView on X
  • ThreatAft@ThreatAft

    🔐Control Web Panel: 3 CVSS 9.8 flaws, one day. CVE-2026-73695 — path traversal → LFI CVE-2026-73696 — auth bypass (no password, just a username) CVE-2026-73697 — file write + shell_exec in phpini_editor Patch to CWP 1.16. https://threataft.com/articles/control-web-panel-cve-2026-73695-73696-73697 #CyberSecurity #CVE #Infosec

    0002074
    56 followersView on X

Explore more

Back to dashboard