Control Web Panel CVE-2026-73695

Exploitation requires a valid low-privileged authenticated CWP session (CVSS PR:L) and targets the services/users/index.php endpoint, where the attacker-supplied module name is concatenated into an include path with no allowlist, basename() call, or traversal sanitization. The attacker supplies directory traversal sequences in the module name to include arbitrary local .php files. Limiting factors: authentication to the panel is needed (not fully unauthenticated), and impact depends on the presence of a local .php file whose contents the attacker can influence to achieve code execution; instances already updated to version 1.16 are not affected.

This is a genuine priority though not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack requiring only low-level authentication and no user interaction, with high impact to confidentiality, integrity and availability (VC:H/VI:H/VA:H), yielding a High base score of 8.7. CWE-98 (PHP file inclusion) combined with the ability to include arbitrary local .php files typically escalates to code execution within the web stack, which is why all three impact metrics are High. The vuln.today decision label is 'this_week' rather than act_now/emergency, consistent with a serious but authentication-gated flaw. No EPSS score and no CISA KEV entry were provided in the input, and no confirmed public exploit code is indicated - a VulnCheck advisory reference exists but is not marked as working exploit code. The PR:L requirement is the key mitigating signal: an attacker needs a valid (if low-privileged) CWP account, so this is not a fully unauthenticated internet-wide mass-exploitation scenario. Missing data: EPSS probability and KEV status are absent, so widespread active exploitation cannot be confirmed or ruled out from the supplied signals alone.

A low-privileged authenticated CWP user sends a request to services/users/index.php supplying a module name containing directory traversal sequences, causing the application to include an attacker-chosen local .php file. If the attacker can place or point to a PHP file whose content they control (e.g. a log, upload, or session file), this results in local PHP file inclusion and likely code execution in the web panel's context. No public working exploit code is identified at time of analysis, though a VulnCheck advisory describing the flaw exists.