On this page (7 sections)
A critical vulnerability, CVE-2026-73695, has been published for Control Web Panel (CWP), a web hosting control panel. According to the GitHub Advisory Database entry, versions before webpanel_version 1.16 contain a path traversal flaw in services/users/index.php that leads to local PHP file inclusion.
If you run a server with CWP, whether as a hosting provider, an agency or a business managing its own VPS, you should check your panel version today. The public record is thin so far, so this article separates what is confirmed from what is not.
What happened
The advisory was published on November 2, 2026 and describes a flaw in how CWP loads modules in services/users/index.php. A module name supplied by the requester is joined directly into a file path that PHP then includes. The code applies no allowlist, no basename() call and no traversal sanitization.
Because of that, an attacker can add directory traversal sequences to the module name and make the application include other .php files that already exist on the server. The advisory calls this local PHP file inclusion. It also references the Control Web Panel changelog and a VulnCheck advisory for further detail.
Technical details in plain terms
Many PHP applications pick a page or feature based on a request parameter, for example loading a file named after a module. That is safe only if the application restricts the value to a known list. Here, the value goes straight into the include path, so the attacker decides which file is loaded, not the developer.
A path traversal sequence is a way of climbing out of the intended folder and pointing to a file elsewhere on disk. When the target is included by PHP rather than just read, any PHP code in that file runs in the context of the panel. The practical consequence depends on which .php files exist on the server and what they do when loaded out of context. The sources do not say what an attacker could chain this to, so treat claims of guaranteed remote code execution as unconfirmed.
How the score reads
The GitHub advisory lists these CVSS v4 base metrics:
- Attack vector: network
- Attack complexity: low, with no attack requirements
- Privileges required: none
- User interaction: none
- Impact on the vulnerable system: high for confidentiality, integrity and availability
- Impact on subsequent systems: none
In short, the scoring describes an attack that can be launched remotely, without an account and without tricking anyone. That is why it lands at 9.3. Note that the advisory is marked Unreviewed in the GitHub database, and the NVD entry repeats the same description rather than adding independent confirmation.
Who is affected
Any server running Control Web Panel with a webpanel_version below 1.16 should be considered in scope. The advisory lists no package and says affected and patched versions are unknown, so the "before 1.16" wording in the description is the only version boundary available.
Control panels are attractive targets because they sit on the server with broad privileges and are often reachable from the internet on a dedicated port. A panel flaw can affect every site hosted on that machine, not just one.
How to check your exposure
First, find your installed panel version in the CWP admin interface or through your usual server inventory, and compare it with 1.16. The advisory references the CWP changelog; check the vendor's release notes for the update you plan to install.
Next, look for signs that someone has already probed the panel. This read-only command searches a web server access log for directory traversal sequences in requests. Run it on the server, and replace the log path with the one your setup actually uses; the path below is only a placeholder. Any hits on panel URLs deserve a closer look, though some hits will be harmless scanners.
grep -E '\.\./|%2e%2e' /path/to/access.log | head -n 50Also review who can reach the panel at all. If the panel port is open to the whole internet, tighten that as described in the next section.
What to do now
0 of 7 done
If you suspect the server was already compromised, our guide on what to do when a website is hacked walks through containment and cleanup.
Detection and monitoring afterwards
After patching, keep watching the server. Alert on new files appearing in web-accessible and panel directories, on logins from unfamiliar locations, and on spikes of requests containing encoded traversal strings. Keep panel software on a regular update schedule, since control panels tend to attract repeated attention once one bug is public.
From the outside, you can also watch your sites for unexpected changes. Webforta Monitor tracks uptime, certificate, DNS and header changes, and our free malware scanner can check a site for visible signs of injected content. Outside-in checks cannot see inside the server, so they complement, not replace, log review and patching. Our page on what outside-in malware detection can and cannot see explains the limits.
Timeline
| Date | Event |
|---|---|
| 2026-11-02 | CVE-2026-73695 published by NVD and added to the GitHub Advisory Database (unreviewed) |
| 2026-11-02 | Advisory last updated; no patched version formally listed |
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.