The vulnerability is a path traversal flaw in the services/users/index.php file of Control Web Panel. An attacker can supply an unsanitized module name parameter containing directory traversal sequences which is concatenated directly into an include path. By choosing an arbitrary local PHP file, the attacker can cause the server to include and execute that file, leading to remote code execution in the context of the CWP user panel.

All installations of Control Web Panel older than version 1.16 are vulnerable, including the default package from the control-webpanel website. The affected product is Control Web Panel, commonly used for managing web hosting servers.

The flaw carries a CVSS base score of 8.7, indicating high severity. Since the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, there is no publicly known exploit count at this time, but the nature of the flaw makes it straightforward to exploit if an attacker can supply the module name parameter, such as through a URL or form input. Successful exploitation results in arbitrary PHP code execution on the affected server.