CVE-2026-73697 Details

An arbitrary file write and operating system command injection vulnerability has been identified in Control Web Panel (CWP) versions prior to 1.16. This vulnerability resides in the phpini_editor user panel module, allowing attackers with access to the module to write attacker-controlled content to arbitrary paths and execute OS commands. Exploitation involves using the acc=update action to write files via file_put_contents without path confinement, and the acc=addlabelphpiniadv action to inject unsanitized input into shell_exec, thereby executing code in the user panel context.