Control Web Panel CVE-2026-73697

Requires an authenticated CWP user-panel account with access to the phpini_editor module (consistent with PR:L); no user interaction or non-default configuration is indicated - the two vulnerable actions (acc=update, acc=addlabelphpiniadv) are standard module functionality. The arbitrary file write succeeds because file_put_contents applies no path confinement, and command injection succeeds because acc=addlabelphpiniadv input reaches shell_exec unescaped. The primary limiting factor is the need for valid low-privileged panel credentials; affected deployments are CWP installations before webpanel_version 1.16.

This is a credible near-term priority rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity flaw with no user interaction and no special attack requirements, requiring only low privileges - consistent with the description's 'attacker with access to the module', i.e. an authenticated CWP user panel account. Impact is maximal (VC:H/VI:H/VA:H) because the two primitives (arbitrary file write via unconfined file_put_contents on acc=update, and unsanitized shell_exec on acc=addlabelphpiniadv) each yield remote code execution. A vendor patch exists and the vuln.today decision label is 'this_week', which sets the urgency; it is not act_now/emergency. The finding is attributed to VulnCheck with an advisory reference. No EPSS score was provided, the CVE is not listed as CISA KEV in the input, and no confirmed public exploit code is indicated, so exploitation is plausible-but-not-confirmed; the main mitigating factor is the required authenticated panel account, which narrows the attacker population to users who already hold (or can obtain) a CWP user-panel login.

An attacker holding a low-privileged CWP user panel account opens the phpini_editor module and issues an acc=update request that writes attacker-controlled content to an arbitrary path (e.g. a web-accessible PHP file or a script path), or issues acc=addlabelphpiniadv with shell metacharacters that flow unescaped into shell_exec. Either path yields OS command execution on the hosting server. No confirmed working exploit code is identified in the input, though a VulnCheck advisory documents the flaw.