Control Web Panel's three CVEs say fixed in 1.12 and 1.16; the vendor changelog lists no 1.16 and names no CVE
Three Control Web Panel CVE records published 2 November 2026 say fixed before 1.12 and before 1.16. The vendor's changelog has no 1.16 entry and names none of them, and GitHub's text about a username giving root is in none of the records.
By Parminder Kumar Sharma · LinkedIn · · 14 min read
Two fix versions, one changelog, no 1.16
Three Control Web Panel (CWP) CVE records published on 2 November 2026 name two fix thresholds: before 1.12 for one flaw and before 1.16 for the other two. The vendor's own public changelog, read at about 18:35 GMT the same day, has an entry for 1.12 dated 8 September and none for 1.16. Its entries run from 1.12 straight to 1.26, dated 26 October, which leaves 48 days (derived) with nothing listed in between. None of its entries names any of the three CVEs.
That does not mean there is no fix. It means a defender cannot confirm from the vendor's page which release carries which fix. The records label the number "webpanel_version"; the changelog never uses that label, and one line of it refers to "CWP 1.28". What the pages read do not establish is which number a server's panel displays, which release fixes which flaw, how many servers are exposed, or whether anyone has used any of the three.
CWP describes itself as a free Linux hosting panel with a separate panel for end users. Its CVE records were assigned by VulnCheck as the CNA, the CVE numbering authority, and carry the same credit to an outside researcher on all three. This briefing reads the three CVE records, NVD, three GitHub advisories, VulnCheck's three advisory pages, the CWP changelog and home page, and CISA's exploited vulnerabilities catalogue, between 18:33 and 18:36 GMT on 2 November 2026. VulnCheck sells vulnerability intelligence, so it has a commercial interest in advisories being read; the CWP project sells a paid tier, CWPpro, so it has an interest in how fixes are described.
The three records side by side
Each record below is the CNA's text from CVE.org, copied into the table in short form. NVD, read the same afternoon, carries the same descriptions and scores, with the status "Received", meaning NVD had not yet analysed them. The scores in the last column are CVSS 3.1: the first is the CVE record (assigned by VulnCheck), the second is what GitHub's advisory page prints.
The three CWP records as read from CVE.org, NVD and GitHub's advisory feed on 2 November 2026. Scores are CVSS 3.1; vectors are in the Technical details section.
| CVE and class | What the CVE record says it allows | Range and score (record, then GitHub) |
|---|---|---|
| CVE-2026-73696, execution after redirect (CWE-698) | Unauthenticated attackers bypass authentication in the user panel because an exit() call is missing after a redirect header, reaching user panel functionality that should require authentication. | Before 1.12. 9.1 critical in the record, 9.8 on GitHub. |
| CVE-2026-73695, path traversal into a PHP include (CWE-98) | An unsanitized module name in services/users/index.php is concatenated into an include path, giving local file inclusion and PHP code execution in the user panel context. | Before 1.16. 8.8 high in the record, 9.8 on GitHub. |
| CVE-2026-73697, file write and command injection (CWE-78 and CWE-22) | Attackers with access to the phpini_editor user panel module write files to arbitrary paths and run OS commands, with code execution in the user panel context. | Before 1.16. 8.8 high in the record, 9.8 on GitHub. |
Three details matter more than the headline scores. Two of the three records rate the flaw high rather than critical. The two before 1.16 records score privileges required as low, so on the CNA's own reading they need a logged in user or equivalent access. Whether the redirect flaw supplies that access is the inference taken up below. And CVE-2026-73697 lists two weaknesses, command injection and path traversal, while GitHub's page for it lists only the path traversal one.
Two sources, two stories about what an attacker needs
The text most readers will meet first is GitHub's advisory for CVE-2026-73696, published at 15:31 GMT. It says attackers with "nothing more than a valid hosting username" can bypass authentication to reach user panel module code paths, "enabling a pre-authentication chain to root access". It also prints the function names toLoginWithIntendedUri() and unauthenticatedFlow().
Neither the username requirement nor the chain to root appears in the CVE record, in NVD's copy (last modified 18:18 GMT), or on VulnCheck's own advisory page for the flaw. Those three say "unauthenticated attackers" and stop at reaching user panel functionality. The CVE record scores it 9.1 with no availability impact; GitHub prints 9.8 with full availability impact. GitHub marks its advisory "unreviewed", lists no credits and no affected package. Where its wording and scores came from is not stated on any page read.
The VulnCheck addresses that GitHub's three advisories list as references returned "not found" when requested at about 18:34 GMT. The addresses in the CVE records worked. So the claim that a hosting username is enough, and that the result is root, rests on one unreviewed page. Treat it as a warning worth acting on, not as a finding the CNA has published.
A step between the records is also missing. The redirect flaw is described as reaching user panel functionality without logging in. The file write and command injection flaw is described as needing "access to the module". Putting the two together is the obvious reading, and it is inference: no record or advisory read says the three chain, and the two module flaws are both described as giving code execution "in the user panel context", not as root. Which account that context runs as is not stated.
Redirect without exit: a bug class that looks fixed from the browser
Execution after redirect is a classic PHP mistake, listed as CWE-698. A script that finds no valid session sends a Location header and the browser obediently goes to the login page. The header is only an instruction to the browser. Unless the script stops, the server carries on and runs whatever code comes next. In a normal test, with a browser, nobody sees the problem, because the page that loads is the login page.
As the records describe it, the user panel's authentication flow does exactly that: it decides the caller is not logged in, emits the redirect, and the module dispatcher include still runs. A client that simply does not follow the redirect is not stopped by it, because the check was never enforced on the server. The fix for the class is one line, an exit after the header. A defender cannot spot it by looking at what the browser shows, which is why logs of the requests themselves matter more than the screens users saw.
Which number a server shows, and what 1.12 to 1.15 means
Read literally, the records say this. A server below 1.12 is listed for all three flaws. A server from 1.12 up to, but not including, 1.16 is listed for CVE-2026-73695 and CVE-2026-73697 but not for the redirect flaw. A server on 1.16 or later is listed for none. That is the answer for anyone on 1.12 to 1.15: the redirect flaw is closed, and the two module flaws that need a logged in user, or on the GitHub reading a way past the login, are not.
The "if the number means what the CVE says" caveat is the weak point. The changelog numbers its releases 1.2, 1.9, 1.12, then 1.26 to 1.30, and refers to "CWP 1.28" in a line about migrations. The records say "webpanel_version". The changelog does not say that these are the same number, and it has no 1.16 entry to say what changed at that version. Possible readings are that the two numbers are the same and 1.16 simply was not logged, or that webpanel_version is a component number that the changelog does not mention. This site cannot tell which; the vendor can.
Two further points from the vendor's pages, stated as printed. The changelog for 1.30 says its update channels are "LTS (default for every server" and Edge, and that an Edge build is published separately, so a server's channel decides which release it can reach. And the home page for the paid tier says CWPpro ships "Fast automatic security fixes" and the "Latest CWP version first", while the free tier is listed without those lines. Whether the free tier has received the three fixes is not stated.
Dates: reserved, fixed, published
Dates read from the CVE records, GitHub's advisory feed and the CWP changelog on 2 November 2026. The last column is arithmetic by this site.
| Event | Date as printed | Days before 2 November (derived) |
|---|---|---|
| CVE IDs reserved by VulnCheck (all three) | 13 August 2026 | 81 |
| Changelog entry 1.12, listing user panel "Security improvements" | 8 September 2026 | 55 |
| Changelog entry 1.26 (user panel security fixes in general terms) | 26 October 2026 | 7 |
| Changelog entries 1.27 and 1.28 | 30 October 2026 | 3 |
| Changelog entries 1.29 and 1.30 | 31 October 2026 | 2 |
| CVE records published (three, between 14:51 and 14:53 GMT) | 2 November 2026 | 0 |
The IDs were reserved 81 days (derived) before they were published. If the 1.12 entry is the fix for the redirect flaw, which the changelog does not say, the fix preceded publication by 55 days. The changelog then records 6 calendar days, 26 to 31 October, with five releases (derived: 1.26 to 1.30). Their user panel entries are broad. 1.26 says "file and folder actions are confined to the user's home", 1.27 describes "a large security review of all admin modules" that fixed path traversal among other classes, and 1.29 says the user panel internal API was hardened and a legacy internal action "that ran arbitrary commands was removed". None names the phpini_editor module, a module name include or a redirect, so this site does not claim they are the 1.16 fixes.
The pattern fits a vendor that fixed a lot at once and wrote it up in general terms, with a CNA publishing specific records afterwards. It also fits a reader who runs an older release and sees nothing in the changelog to tell them whether they are affected. Only the first half of that is supported by the pages read; the second half is the practical problem.
Is anyone using these, and how many servers run CWP
Nothing read says so. CISA's exploited vulnerabilities catalogue, version 2026.10.30, released 30 October at 17:02 GMT with 1,766 entries, predates the CVE records by two days, so it cannot contain them and the check proves little. CISA's own enrichment on the CVE records, a decision model entry added on 2 November, reads Exploitation: none for both records that carry one. For CVE-2026-73696 (17:14 GMT) it also reads Automatable: yes and Technical Impact: total; for CVE-2026-73697 (15:49 GMT) Automatable: no and Technical Impact: total. The record for CVE-2026-73695 had no CISA entry when read. VulnCheck's advisory pages say nothing about exploitation, and its own exploited vulnerabilities list was not checked.
The catalogue does list two earlier CWP vulnerabilities as exploited: CVE-2022-44877, added 17 January 2023, and CVE-2025-48703, added 4 November 2025. Of the second, CISA's description says "A valid non-root username must be known." That is a different flaw, but it shows the catalogue has treated a known username as the precondition for an unauthenticated CWP attack before, and that CWP has been a target.
On scale, the only figure read is the vendor's: its home page says "35,000+ servers running CWP". That is a marketing line about all installs, not a count of servers exposed to these flaws, and it carries no date. How many run a vulnerable version, and how many expose the user panel to the internet, is not stated by anything read.
What is stated, and what is not
Claims about the three CWP flaws, set against the pages read on 2 November 2026.
| Claim | Stated by | Not stated |
|---|---|---|
| Three flaws exist, fixed before 1.12 and before 1.16 | CVE records, NVD, VulnCheck | Which release number a panel displays; what changed at 1.16 |
| Authentication can be bypassed without logging in (CVE-2026-73696) | CVE record, VulnCheck, GitHub | Which modules an anonymous caller reaches |
| A valid hosting username is enough | GitHub advisory text only | Anywhere in the CVE record, NVD or VulnCheck |
| The flaws chain to root | GitHub advisory text only (for 73696) | Any record, any demonstration, which account the panel runs as |
| All three are critical | GitHub (9.8 each) | CVE records rate 73695 and 73697 as high (8.8) |
| A fix is published | The records tag the changelog as the patch | A 1.16 entry; any CVE named in it |
| The flaws are exploited | Nothing read | CISA's decision model entries say Exploitation: none |
| Many servers are exposed | Vendor home page: 35,000+ servers run CWP | How many run a vulnerable version or expose the panel |
What to do, in order
Take this with you
A ranked checklist for CWP operators and hosting providers
- Find the version the panel shows, then move to the newest release the changelog lists. On 2 November that is 1.30, dated 31 October, which is above both thresholds if the changelog and the records use one numbering scheme. Ask the vendor to confirm that, and which release carries each fix.
- Check the update channel and tier. The 1.30 entry says LTS is the default and that Edge builds are published separately; make sure the server can actually reach the release you want, and note that the vendor's page ties faster fixes to the paid tier.
- If you cannot update at once, restrict the user panel and admin panel ports to trusted networks. This is this site's suggestion, not a CWP instruction. The vendor's home page lists the panel ports as 2030 to 2304; the changelog also names ports 2302, 2304, 2095 and 2096.
- Hosting providers: this site suggests reviewing panel and web server logs since mid August for requests that reached user panel modules without a session, for edits to PHP settings through the phpini_editor module, and for new or changed PHP files written by the panel's web user.
- After any suspected compromise, rotate root, panel and database credentials and review authorised keys, cron jobs and web server configuration. Do not assume that restoring one account's files is enough.
- Treat hosting usernames as not secret. They appear in paths, mail and support tickets. CISA's catalogue entry for an earlier CWP flaw relied on a known username as the only precondition.
Technical details
These are the artifacts the primary sources print: the CNA's descriptions, GitHub's different wording, scores and ranges, and the changelog lines. No exploit code was read, fetched or saved; the sources printed none. The records name two module actions, acc=update and acc=addlabelphpiniadv, which are listed here only as the records print them. A defender can search web server and panel logs for requests to the user panel that carry those action names, and for the module index path, from users who had no session.
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call after a header('Location: ...') redirect. Attackers can send unauthenticated requests to continue PHP execution past the redirect, reaching user panel functionality that should require authentication.
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect header without exit(), allowing PHP execution to continue and the module dispatcher include to run without authentication. Attackers with nothing more than a valid hosting username can bypass authentication to reach user-panel module code paths, enabling a pre-authentication chain to root access.
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an include path. Attackers can inject directory traversal sequences into the module name to achieve local file inclusion and execute arbitrary PHP code in the user panel context.
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file_put_contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell_exec, achieving code execution in the user panel context.
The next block sets out the machine readable fields. The CVE records give each flaw an affected range with a lower bound of 0 and an upper bound that is excluded. GitHub prints CVSS 3.1 vectors with all three impact values high and a privileges required value of none for all three, which differs from the CVE records.
CVE-2026-73696 title: Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
range: version 0 lessThan 1.12 (versionType custom)
CVSS 3.1: 9.1 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 4.0: 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
GitHub CVSS 3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-73695 title: Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
range: version 0 lessThan 1.16 (versionType custom)
CVSS 3.1: 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0: 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
GitHub CVSS 3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2026-73697 title: Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
range: version 0 lessThan 1.16 (versionType custom)
CVSS 3.1: 8.8 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0: 8.7 HIGH CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
GitHub CVSS 3.1: 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE criteria, all three: cpe:2.3:a:control-webpanel:webpanel:*:*:*:*:*:*:*:* (versionEndExcluding 1.12 for 73696, 1.16 for the other two)
Reserved 2026-08-13 for all three; published 2026-11-02, 14:51:47 (73695), 14:52:29 (73696), 14:53:27 (73697) UTC
The changelog lines below are the vendor's entry for 1.12 and the user panel security lines of 1.26 and 1.29, copied from its page. The 1.12 entry uses a dash as a bullet, shown here as a hyphen. There is no 1.16 entry to copy.
Version 1.12 released 08/09/2026
FIXED ADMIN UPDATED
- Backup System Improvements
- Enhanced API Security
FIXED USER UPDATED
- Security improvements
- Fix WordPress tool module
Version 1.26 released 26/10/2026
Security: file and folder actions are confined to the user's home; command injection fixes in ModSecurity, Disk Usage and Backups; password recovery uses secure random tokens and no longer leaks tokens or SQL errors.
Version 1.29 released 31/10/2026
User panel internal API: several actions (package usage, statistics, SpamExperts, mail pipes, backup start and database restore) now require a valid session; user login and language lookups validate all values and handle files in the home directory with the account's own permissions.
catalogVersion: 2026.10.30 dateReleased: 2026-10-30T17:02:45Z count: 1766
CVE-2026-73695 in catalogue: no
CVE-2026-73696 in catalogue: no
CVE-2026-73697 in catalogue: no
Earlier CWP (Control Web Panel) entries: CVE-2022-44877 added 2023-01-17; CVE-2025-48703 added 2025-11-04
CVE-2025-48703 shortDescription, as printed:
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
CVE-2026-73696 2026-11-02T17:14:12Z Exploitation: none Automatable: yes Technical Impact: total
CVE-2026-73697 2026-11-02T15:49:11Z Exploitation: none Automatable: no Technical Impact: total
The question that exposes the gap
A fix that exists only as a threshold in a CVE record is a promise, not a patch you can check. If the records say fixed before 1.16 and the vendor's changelog has no 1.16, what exactly did your last update install, and who at the vendor can say so in writing?
Key facts
Sources
- PrimaryCVE-2026-73696 record: execution after redirect, before 1.12, CVSS 3.1 9.1 and 4.0 9.3, CWE-698, reserved 13 August, published 2 November, CISA decision model entry. Read in fullCVE Program (VulnCheck as CNA)accessed 2026-11-02
- PrimaryCVE-2026-73695 record: path traversal into a PHP include, before 1.16, 8.8 high, CWE-98; no CISA entry when readCVE Program (VulnCheck as CNA)accessed 2026-11-02
- PrimaryCVE-2026-73697 record: file write and command injection in phpini_editor, before 1.16, 8.8 high, CWE-78 and CWE-22, CISA decision model entryCVE Program (VulnCheck as CNA)accessed 2026-11-02
- PrimaryNVD record for CVE-2026-73696: same description and scores as the CNA, status Received, last modified 2 November 18:18 GMTNIST National Vulnerability Databaseaccessed 2026-11-02
- PrimaryNVD record for CVE-2026-73695: same description and scores as the CNA, status ReceivedNIST National Vulnerability Databaseaccessed 2026-11-02
- PrimaryNVD record for CVE-2026-73697: same description and scores as the CNA, status ReceivedNIST National Vulnerability Databaseaccessed 2026-11-02
- PrimaryAdvisory for CVE-2026-73696, published 2 November 15:31 GMT, marked unreviewed: the wording about a hosting username and a chain to root, the function names, CVSS 3.1 9.8, no creditsGitHub Advisory Databaseaccessed 2026-11-02
- PrimaryAdvisory for CVE-2026-73695: path traversal wording, CVSS 3.1 9.8, unreviewedGitHub Advisory Databaseaccessed 2026-11-02
- PrimaryAdvisory for CVE-2026-73697: file write and command injection wording, CVSS 3.1 9.8, unreviewedGitHub Advisory Databaseaccessed 2026-11-02
- PrimaryVulnCheck advisory for CVE-2026-73696: critical, 9.3, credit, the CNA description; no username or root wordingVulnCheckaccessed 2026-11-02
- PrimaryVulnCheck advisory for CVE-2026-73695: high, 8.7, the CNA descriptionVulnCheckaccessed 2026-11-02
- PrimaryVulnCheck advisory for CVE-2026-73697: high, 8.7, the CNA descriptionVulnCheckaccessed 2026-11-02
- PrimaryThe vendor changelog: releases 1.30 to 1.26 (26 to 31 October), 1.12 (8 September), 1.9 and 1.2; no 1.16 entry and no CVE named; update channels. Read in fullControl Web Panelaccessed 2026-11-02
- PrimaryThe vendor home page: the 35,000+ servers claim, the free and CWPpro tiers, the panel port range 2030 to 2304. Marketing claims, not measurementsControl Web Panelaccessed 2026-11-02
- PrimaryKnown Exploited Vulnerabilities catalogue, version 2026.10.30, released 30 October 17:02 GMT, 1,766 entries: none of the three CVEs; two earlier CWP entriesCISAaccessed 2026-11-02
