CVE-2026-73697

Control Web Panel (CWP) before webpanel version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitrary paths and execute arbitrary OS commands. Attackers can exploit the acc=update action to write files via file put contents without path confinement and the acc=addlabelphpiniadv action to pass unsanitized input into shell exec, achieving code execution in the user panel context.