CVE-2026-73695

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 1.16

Description A path traversal issue exists in the services/users/index.php endpoint. This occurs because the module name parameter is not properly sanitized before being concatenated into an include path. An attacker can use directory traversal sequences in this parameter to perform local file inclusion, allowing the execution of arbitrary PHP code within the user panel context.

Recommendations Update Control Web Panel to version 1.16 or later. As a temporary mitigation, restrict access to the services/users/index.php endpoint.