Description
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.
Published: 2026-11-02
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: Remote Code Execution via file write and OS command injection
Action: Immediate Patch
AI Analysis

Impact

Control Web Panel before version 1.16 exposes a flaw in the phpini_editor user panel module that allows an attacker with module access to write arbitrary data to any file path and to execute arbitrary operating‑system commands. This combination of writable paths and unsanitized use of shell_exec enables full code execution within the user panel context, representing a severe compromise of confidentiality, integrity, and availability.

Affected Systems

Vulnerable instances are Control Web Panel installations with a webpanel_version earlier than 1.16. Any user that can reach the phpini_editor module on the web interface is at risk.

Risk and Exploitability

The CVSS score of 8.7 places this issue in the High severity range. EPSS data is not available, and the vulnerability is not listed in CISA KEV, indicating no confirmed exploitation yet. However, the attack requires network access to the web interface and valid credentials or existing module privileges. Once those conditions are met, the lack of path confinement and the direct use of shell_exec create a straightforward exploitation path for an attacker to achieve remote code execution.

Generated by OpenCVE AI on November 2, 2026 at 16:38 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Control Web Panel to version 1.16 or later to remove the phpini_editor vulnerability.
  • If an upgrade is not immediately possible, disable or restrict web access to the phpini_editor module so only trusted users can reach it.
  • Implement rigorous input validation and filesystem path restrictions, ensuring that file_put_contents cannot write outside intended directories and that any shell_exec calls are either removed or fully sanitized.

Generated by OpenCVE AI on November 2, 2026 at 16:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
First Time appeared Control Web Panel
Control Web Panel control Web Panel
Vendors & Products Control Web Panel
Control Web Panel control Web Panel

Mon, 02 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 02 Nov 2026 15:30:00 +0000

Type Values Removed Values Added
Description Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution. Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.
Title Control Web Panel (CWP) < 1.16 File Write and Command Injection Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

 cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Mon, 02 Nov 2026 15:00:00 +0000

Type Values Removed Values Added
Description Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via file_put_contents with no path confinement, and the acc=addlabelphpiniadv action passes unsanitized attacker input into shell_exec without escaping. An attacker with access to the module can write arbitrary files and execute arbitrary OS commands, resulting in remote code execution.
Title Control Web Panel (CWP) < 1.16 File Write and Command Injection
First Time appeared Control-webpanel
Control-webpanel webpanel
Weaknesses CWE-22
CWE-78
CPEs cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:*
Vendors & Products Control-webpanel
Control-webpanel webpanel
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Control-webpanel Webpanel
Control Web Panel Control Web Panel
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-02T15:49:23.228Z

Reserved: 2026-08-13T15:15:54.513Z

Link: CVE-2026-73697

cve-icon Vulnrichment

Updated: 2026-11-02T15:49:18.975Z

cve-icon NVD

Status : Deferred

Published: 2026-11-02T15:17:37.660

Modified: 2026-11-02T19:35:33.347

Link: CVE-2026-73697

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-02T16:45:17Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')