On this page (7 sections)
A critical vulnerability, CVE-2026-73697, affects Control Web Panel (CWP) versions before webpanel_version 1.16. According to the GitHub advisory, the phpini_editor user panel module can be used to write arbitrary files and to run operating system commands, which adds up to remote code execution on the server.
If you run a server managed with CWP, or host customer sites on one, you should check your panel version now. The record was published on November 2, 2026, and the research we have contains no report of exploitation in the wild.
What happened
The National Vulnerability Database entry describes two problems in the phpini_editor module of the CWP user panel. Both are reachable through different actions of the same module.
- The acc=update action writes content chosen by the attacker to a path chosen by the attacker, using PHP's file_put_contents, with no restriction on where the path points.
- The acc=addlabelphpiniadv action passes attacker-supplied input to shell_exec without escaping it, which is classic OS command injection.
The advisory states that an attacker with access to the module can write arbitrary files and execute arbitrary OS commands. The record also points to the CWP changelog and a VulnCheck advisory as references.
Why this class of bug is dangerous
An arbitrary file write with no path confinement means the application will save data wherever the requester says. On a web server that can mean dropping a script into a web-accessible directory or overwriting a configuration file. Command injection is a separate route to the same result: user input ends up inside a shell command, so the shell may treat part of it as instructions.
A PHP settings editor is a sensitive place for these flaws, because it is built to touch configuration files and, in some cases, to call system tools. Control panels also usually run with high privileges, so code execution through a panel module can be far more serious than code execution inside a single website.
Who is affected and how exposed you are
Any server running CWP before webpanel_version 1.16 is in scope. The sources do not agree on how much access an attacker needs. The CVSS v4 metrics on the GitHub advisory list privileges required as none and attack vector as network, while the description says an attacker needs access to the module. We cannot resolve this from the research, so assume the worst case: treat any CWP panel reachable from the internet as exposed until it is updated.
Shared hosting and reseller servers deserve extra attention. If the module is reachable by ordinary panel users, every customer account is a potential starting point.
How to check your exposure
First find out which CWP version you run. The version is normally shown in the panel's admin interface. Compare it with the changelog on the CWP site and confirm you are on webpanel_version 1.16 or later.
Next, check who can reach the panel. This read-only command lists listening TCP ports on the server so you can see whether the panel ports are open on all interfaces. Run it as root and look for the ports your CWP installation uses.
ss -tlnpThen look for signs that the module has already been abused. This command searches logs for requests that mention the module name. The log path varies by setup, so adjust it to where your logs live; unexpected requests from unfamiliar addresses are worth investigating.
grep -r "phpini_editor" /var/log/ 2>/dev/null | head -n 50What to do now
0 of 7 done
For a broader plan if you suspect a break-in, see our guide on what to do when a website is hacked and how to check if a website is hacked.
Detection and monitoring afterwards
After patching, keep watching for change. Unexpected new files, altered PHP configuration and unfamiliar processes are the typical traces of a file-write and command-injection chain. Keep panel and web server logs long enough to look back at least several weeks.
Outside-in checks can add a second view of your public sites, for example monitoring for DNS, certificate and header changes, or a free malware scan of a website. These look at what visitors can see and cannot tell you whether the server itself is clean, as explained in what outside-in malware detection can and cannot see.
What we do not know yet
- Whether attackers are exploiting CVE-2026-73697. The CVE record shows no CISA KEV listing and the sources report no exploitation.
- Exactly what level of access is needed to reach the phpini_editor module, given the differing signals described above.
- Which specific versions are affected beyond 'before webpanel_version 1.16', since the GitHub advisory lists affected and patched versions as unknown.
We will treat the vendor changelog and the CVE record as the places to watch for clarification.
Sources
This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.