External risk intelligence

Control Web Panel Path Traversal Leading to Local PHP File Inclusion

CVE advisorySeverity: HIGH (CVSS 8.7)

CVE-2026-73695

Control Web Panel (CWP) is a web-based server management platform designed to be exposed to the internet to allow administrators to manage web hosting services, DNS, and email configurations. Given its role as a public-facing web management interface, it is highly likely to be deployed with internet exposure.

Path Traversal

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Control Web Panel could allow unauthorized access to system files. This issue affects the underlying technology used for web server management, posing a risk if exploited. The main concern is confirming relevance and exposure to your specific environment.

Allows unauthorized file access.
Matters for server management security.
Confirm if your systems are affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by accessing the web panel remotely. They would then provide a specially crafted module name that includes directory traversal sequences to manipulate the include path. This allows the attacker to include arbitrary local PHP files, potentially leading to the execution of malicious code.

No authentication required to start.
Malicious module name triggers file inclusion.
Local PHP file inclusion.

Live Threat

Current exploitation, exposure, and threat context

A path traversal vulnerability in the CWP web application could allow an unauthenticated attacker to include arbitrary local PHP files. This could potentially lead to the execution of malicious code when supported by the advisory's conditions.

Arbitrary local PHP files.
Via specially crafted module name parameter.
Local PHP file inclusion.

Operational Fix

Recommended remediation, mitigation, and detection steps

Responsible teams should first identify all Control Web Panel instances, determine their network exposure and business criticality, and then confirm ownership before planning remediation. Coordination with the vendor or a qualified third party may be necessary if internal resources are limited.

Identify and confirm all CWP instances.
Verify network exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Control Web Panel (CWP)?

Control Web Panel is a web-based server management platform. It provides a graphical interface for administrators to configure web hosting, email services, and DNS settings on a server. Because it manages core infrastructure, it is typically installed on Linux servers to simplify complex management tasks through a centralized dashboard.

What does CWE-98 mean for CVE-2026-73695?

CWE-98 refers to Improper Control of Filename for Include/Require Statement in PHP, often called Local File Inclusion. In this CVE, the application takes a module name provided by a user and adds it directly to a file path without checking the input. This allows an attacker to use special characters to 'traverse' outside the intended folder and force the server to load and execute unauthorized PHP files.

How is the path traversal triggered?

The vulnerability is triggered by sending a specially crafted request to the affected script. An attacker inserts directory traversal sequences—such as sequences of dots and slashes—into the module name parameter. This bug does not trigger if the input is properly sanitized or if the application forces a specific, safe path; however, because the code lacks an allowlist or file-name validation, it blindly follows the attacker's manipulated path.

Is my instance affected by CVE-2026-73695?

According to Halo Surface Signal, CWP is designed to be a public-facing management interface, making it highly likely that your instance is exposed to the internet. If your system is reachable from the network, it is a primary candidate for this risk. You should verify your specific version to see if it is older than 1.16, as this version range is where the path traversal weakness is present.

What steps should I take if I use CWP?

First, create an inventory of all CWP instances running in your environment to understand your footprint. Prioritize these assets based on their business criticality and network accessibility. Once you have identified your systems, check the vendor's official changelog for the latest update and coordinate with your infrastructure team to apply the necessary patches to versions 1.16 or higher.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.