CVE-2026-73695

Control Web Panel CWP before webpanelversion 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename, or traversal sanitization. An attacker can supply directory...