CVE-2026-73695

The record

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.

Affected packages

Related vulnerabilities

• CVE-2026-62121 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote… CWE-98
• CVE-2010-20125 DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that… CWE-98
• CVE-2026-110185 The Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google… CWE-98
• CVE-2014-125137 C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through… CWE-98
• CVE-2026-112850 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote… CWE-98
• CVE-2017-20289 Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file… CWE-98
• CVE-2016-20101 Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability… CWE-98
• CVE-2026-87927 MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and… CWE-98