CVE-2026-73695CVSS 8.7Local PHP file inclusion
Before 1.16, the module parameter in services/users/index.php can escape its include directory; the CNA rates this low-privileged access.
Ten Control Web Panel flaws include a demonstrated user-panel-to-root chain
CWP research now covers ten CVEs and demonstrates an unauthenticated user-panel-to-root chain on an older build. After 1.12, local API flaws still need fixes. Research places the final fix at 1.29; CNA bounds say 1.30. Install vendor-recommended 1.30.1 LTS or later; no in-the-wild exploitation is established.
- Disclosed
- Nov 2, 2026
- Updated Nov 3, 2026
- Severity
- CVSS 9.3 × 2
- 10 CVEs tracked here
- Splash zone
- Older CWP user panels; several root API bugs additionally require access to the loopback API
- cwp
- In the wild
- Unknown
- Lab chain and public PoC are documented; in-the-wild attacks are not established.
What happened
The hosting-panel scope, public PoC and laboratory chain support L3; they do not establish attacks in the wild. Scores remain the CNA’s CVSS 4.0 scores. The November 3 full report includes CVE-2026-104080, omitted from our earlier nine-item coverage: this batch has ten CVEs. The public disclosure date remains November 2, when the records were published.
Attack prerequisites: VulnCheck reproduces unauthenticated-to-root access in a CWP7 webpanel 1.8/AlmaLinux 9 lab, despite the build containing the old CVE-2025-48703 fix. The user panel on port 2083 continues executing after a redirect; a valid hosting-account name locates its modules. File-write, include and command paths combine into account-level execution, then reach the root API on 127.0.0.1:2302. That API must be reachable: a local vector alone is not arbitrary internet root RCE. Version 1.12 closes the unauthenticated entry, but later affected builds can still let local hosting accounts escalate. Our earlier caution came from individual records; the full report now demonstrates a chain on a specific build, not every configuration.
Staged fixes and disagreement: CNA bounds are 1.12 for the redirect; 1.16 for file inclusion, phpini_editor, protected_directory, access_token() and /newpass/; and 1.30 for missing API authentication, database restore, blind SQL injection and valid_token command injection. The researcher places the final four fixes in 1.27/1.29 and recommends at least 1.29. It actually decoded and validated 1.30, assigning the earlier two-release split from the changelog rather than independently validating each build. The vendor currently recommends 1.30.1 LTS for every server. Keep that higher recommendation rather than claiming all sources agree 1.29 is the first safe build. Two-component webpanel versions follow the sources; no version checker is offered.
The relevant missing-token loopback routes include /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/ and /user_panel_dashboard/. They are investigative surfaces, not evidence of an attack. The report supplies laboratory exploit examples; their filenames are not an exhaustive malicious-campaign indicator set.
Current update and regression checks: Version 1.30.1 LTS additionally requires API keys on every port-2304 API v1 call, limits internal migration routes to the server, and hardens account actions, one-time login links and HTTPS update downloads. Confirm /usr/local/cwp/.conf/api_strict_guard_off has not disabled the strict guard. Test integrations and mail after updating: servers still on the old default trust list move to 127.0.0.0/8, so other private-network applications need SMTP authentication. A footer-only 1.30.2 label has no corresponding full release entry; it does not replace the explicitly recommended LTS here.
What’s in the bowl
CVE-2026-73696CVSS 9.3Execution after login redirect
Before 1.12, a login redirect does not stop PHP execution, letting unauthenticated requests reach protected user-panel functions.
CVE-2026-73697CVSS 8.7phpini_editor file write and commands
Before 1.16, module access permits unconstrained file writes through acc=update and shell injection through acc=addlabelphpiniadv; CNA rates privileges required as low.
CVE-2026-77876CVSS 9.3protected_directory command injection
Before 1.16, the file POST parameter in acc=deletedp reaches a shell command in the user-panel context.
CVE-2026-77877CVSS 8.6Missing loopback API authentication
Before 1.30, callers that can reach the loopback API can invoke root-privileged routes without an access token.
CVE-2026-77878CVSS 8.6Database-restore API command injection
Before 1.30, a reachable /v1/restoredatabase/ route passes a POST file path into a root shell command.
CVE-2026-77879CVSS 8.5API authentication SQL injection
Before 1.16, authorization_code and client_id are interpolated into a root MySQL query in access_token(); loopback API access is required.
CVE-2026-77880CVSS 8.6Password-route root command injection
Before 1.16, the loopback /newpass/ route uses an unescaped POST user value in a root shell command.
CVE-2026-77881CVSS 6.9Loopback blind SQL injection
Before 1.30, the user parameter in /user_panel_dashboard/, later /valid_token/, enters a root database query; loopback API access is required.
CVE-2026-104080CVSS 8.6valid_token root command injection
CNA says before 1.30, callers reaching loopback /valid_token/ can inject shell metacharacters through user into a root command; the research places its fix at 1.29.
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| Control Web Panel current vendor release | 1.30.1 | Vendor-recommended November 3 LTS; research minimum 1.29 differs from some CNA 1.30 bounds |
Crime-scene timeline
Sep 8, 2026
Vendor releases CWP 1.12
The changelog says security improvements without mapping these CVEs.
Oct 31, 2026
Vendor releases CWP 1.30
The current changelog includes further user-panel and internal API hardening.
Nov 2, 2026
VulnCheck publishes ten related CVE records
Detailed public disclosure date, distinct from the earlier release dates.
Nov 3, 2026
Vendor releases 1.30.1 LTS and recommends it for every server
Further hardens API-key checks, internal calls, one-time login links and update downloads; default mail trust networks also narrow.
Nov 3, 2026
Full research demonstrates the chain and explains staged fixes
Research reproduces unauthenticated-to-root access on CWP7 webpanel 1.8 already patched for CVE-2025-48703, and includes CVE-2026-104080. It validates fixed code in 1.30; the split between 1.27/1.29 relies on the changelog.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- Control Web Panel changelogPrimaryVendor release dates, current update workflow and security changes; no per-CVE patch mapping.
- VulnCheck CVE-2026-73695PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-73696PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-73697PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-77876PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-77877PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-77878PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-77879PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-77880PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-77881PrimaryNovember 2 CNA disclosure; affected range, prerequisites and CVSS 4.0 score.
- VulnCheck CVE-2026-104080PrimaryNovember 2 publication; separate valid_token command injection, loopback prerequisite and affected bound before 1.30.
- VulnCheck full CWP2Shell researchPrimaryNovember 3 technical report, ten-CVE chain, public PoC and staged patch analysis. Fixed code checked in 1.30; 1.27/1.29 split from vendor changelog.