CVE-2026-73697

Control Web Panel CWP before webpanelversion 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpinieditor user panel module. The acc=update action writes attacker-controlled content to an attacker-supplied path via fileputcontents with no path confinement, and...