Control Web Panel Unauthenticated RCE Chain (CVE-2026-73696)

TL;DR

• Control Web Panel before user-panel version 1.12 lets an unauthenticated attacker walk past the login redirect and use the user panel's own modules. Two further flaws turn that access into file writes and OS command execution. VulnCheck published all three advisories on November 2, 2026.
• CVE-2026-73696, the unauthenticated execution-after-redirect bypass, scores 9.3 Critical, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N. CVE-2026-73695 and CVE-2026-73697 each score 8.7 High.
• No exploit, no exploitation and no victim are reported, and none of the three CVEs is in CISA's Known Exploited Vulnerabilities catalog as of November 2, 2026. The researcher, Valentin Lobstein, credits the discovery under the handle Chocapikk.
• Update to the latest CWP release now. The user panel fixes landed in version 1.12 on September 8, 2026, and the panel is now at version 1.30.1. Restrict the user panel port to trusted networks if you cannot update today.

Am I affected?

All of these must hold:

• You run Control Web Panel, the free Linux hosting panel. The vendor states more than 35,000 servers run CWP.
• The user panel is reachable by the attacker. It listens on its own port, 2082 by default, separate from the admin panel on 2030.
• For CVE-2026-73696, the user panel version is below 1.12. For CVE-2026-73695 and CVE-2026-73697, the user panel version is below 1.16.

The three flaws chain but also stand alone. The redirect bypass (CVE-2026-73696) is the unauthenticated entry. The path traversal (CVE-2026-73695) and the phpini_editor flaws (CVE-2026-73697) need a user-panel session, which the bypass provides without credentials. The user-panel fixes shipped two months before the disclosure.

Check the version in the panel interface. The changelog lists user-panel versions separately from admin-panel versions, so a recent admin update does not mean the user panel moved.

How do I fix it?

Update CWP to the current release, 1.30.1, which carries every user-panel fix from 1.12 and 1.16.

1. Back up the server, including /usr/local/cwpsrv and the panel's database. CWP has no uninstaller, so a failed update is difficult to roll back.
2. In the admin panel, run the CWP update to the latest version. Devices multiple versions behind may need more than one update step.
3. Verify the user-panel version afterwards against the vendor changelog, not only the admin-panel version.

Restricting the user panel port is the mitigation while updating waits. The panel listens on 2082 by default; limit it with your firewall to trusted networks. This does not fix any of the three flaws, and hosting customers who need the panel still need access, so treat it as exposure reduction only.

What is the root cause?

Control Web Panel is closed-source, so this section works from VulnCheck's three advisory descriptions, each naming the file, the action and the missing check.

CVE-2026-73696 is an execution-after-redirect flaw, CWE-698, in the user panel's authentication flow, CWPUserIndex. The login check redirects unauthenticated users with a header('Location: ...') call but never calls exit() after it. PHP therefore keeps executing the page. In PHP, a header() call only sends the redirect; it does not stop the script. An unauthenticated request thus continues past the redirect into user-panel functionality that should require a session.

CVE-2026-73695 is a path traversal, CWE-98, in services/users/index.php. The module name parameter is concatenated directly into an include path without sanitization. Directory traversal sequences therefore reach include and load arbitrary local PHP files. Any local file with PHP code becomes executable in the user-panel context.

CVE-2026-73697 is a pair of flaws in the phpini_editor user-panel module, CWE-22 and CWE-78. The acc=update action writes attacker-controlled content to arbitrary paths via file_put_contents with no path confinement. The acc=addlabelphpiniadv action passes unsanitized input into shell_exec. Together they give an arbitrary file write and direct OS command execution in the user-panel context.

How is it exploited?

No public proof of concept exists for any of the three CVEs, so these steps restate the chain VulnCheck's advisories describe.

1. The attacker sends an unauthenticated request to a user-panel page. Instead of stopping at the login redirect, PHP execution continues, and the request reaches user-panel functionality (CVE-2026-73696).
2. With user-panel functions reachable, the attacker loads a module in services/users/index.php whose name carries directory traversal sequences, including an arbitrary local PHP file (CVE-2026-73695).
3. Alternatively or afterwards, the attacker uses the phpini_editor module. The acc=update action writes an attacker-chosen file to an attacker-chosen path, and acc=addlabelphpiniadv feeds unsanitized input to shell_exec, executing OS commands in the user-panel context (CVE-2026-73697).

VulnCheck describes the impact of the traversal as executing arbitrary PHP code, and of the phpini_editor flaws as code execution in the user-panel context. The account that code runs as is the panel's user-panel process, not root.

How does the attack flow?

One sentence: an unauthenticated request skips the login redirect, a module name with traversal sequences reaches the include path, and phpini_editor then writes files or runs shell commands.

What can an attacker do?

The documented impact is arbitrary PHP code execution and OS command execution in the user-panel context, under these conditions:

• The user panel port is reachable by the attacker over the network. All three CVSS vectors record a network attack vector.
• The redirect bypass needs no privileges or user interaction. The two follow-on flaws list low privileges in their vectors, and the bypass is what satisfies that requirement without credentials.
• The traversal loads local files only, so the attacker needs a PHP file on the server to include, or a writable upload location to place one first.

VulnCheck's advisories do not claim root code execution, access to the admin panel or cross-server impact. The user panel runs hosting-customer functions, so executed code inherits that process's reach.

Why does the fix work?

The vendor distributes closed-source builds, so the patch diff is not public to quote. The changelog's user-panel entries record the fixes that map to the three advisories. Version 1.12 lists "Improved security for login and session" and "Improved security on file" entries, and later entries continue the hardening.

Version 1.12 closes the redirect bypass for CVE-2026-73696, and version 1.16 carries the fixes for CVE-2026-73695 and CVE-2026-73697. Any release from 1.16 onward contains all three fixes, and the current release, 1.30.1, does too. Whether every include path and module action beyond these three got the same hardening is not stated publicly, so keep the user panel off the open internet even after updating.

How do I check if I were compromised?

No indicators of compromise are published for these flaws. Use panel-focused checks on the server.

1. Review the user-panel access logs for requests to services/users/index.php or phpini_editor module paths that arrived without a prior login for that session.
2. Inspect the panel's filesystem for PHP files with recent modification times in directories served by the user panel, especially any file whose name contains traversal-looking sequences.
3. Check the phpini_editor storage location for configuration files you did not create, and review shell command history and cron for entries referencing panel paths.

An attempt that failed may leave no trace, because a redirected request that went no further writes nothing. If your user panel was internet-facing, treat a review as due regardless of what the logs show.

Timeline

• 2026-09-08: CWP user-panel version 1.12 ships, closing the redirect bypass.
• 2026-10-31: CWP version 1.30 ships, carrying all user-panel fixes to date.
• 2026-11-02: VulnCheck publishes three advisories crediting Valentin Lobstein (Chocapikk), and the three CVE records are published.

FAQ

Is the admin panel affected too?

The three advisories describe the user panel, its login flow and its modules. The admin panel on port 2030 is a separate interface. VulnCheck's advisories do not claim the flaws reach it, and admin access has its own authentication path.

Does the redirect bypass give code execution on its own?

No. CVE-2026-73696 lets an unauthenticated request reach user-panel functionality. Code execution comes from CVE-2026-73695's include path or CVE-2026-73697's write and shell commands, which the bypass makes reachable without credentials.

Why do the fixed versions differ across the three CVEs?

The redirect bypass was fixed in user-panel version 1.12 on September 8, 2026, while the traversal and phpini_editor fixes arrived in version 1.16. A server on 1.12 through 1.15 still carries two of the three flaws.

How big is the deployment?

The vendor states more than 35,000 servers run Control Web Panel, with a community of 94,000 members. The product targets AlmaLinux, Rocky Linux, RHEL and CentOS hosting servers.

Was this wormable?

No source claims self-propagation. The chain needs the user-panel port reachable, and nothing in the advisories describes the panel spreading to other hosts on its own.

Inventory your hosting panels with Ostorlab

Ostorlab's attack surface discovery inventories the internet-facing hosts in your ranges, so you can find every server exposing a hosting-panel port such as 2082 or 2030. Check each version against the advisory. Start a scan with Ostorlab to know which panels to update first.

References

• VulnCheck advisory for CVE-2026-73696, "Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex", published November 2, 2026, CVSS v4.0 9.3 Critical, CWE-698: https://www.vulncheck.com/advisories/control-web-panel-cwp-execution-after-redirect-in-cwpuserindex (checked November 2, 2026)
• VulnCheck advisory for CVE-2026-73695, "Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php", published November 2, 2026, CVSS v4.0 8.7 High, CWE-98: https://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php (checked November 2, 2026)
• VulnCheck advisory for CVE-2026-73697, "Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor", published November 2, 2026, CVSS v4.0 8.7 High, CWE-22 and CWE-78: https://www.vulncheck.com/advisories/control-web-panel-cwp-file-write-and-command-injection-via-phpini-editor (checked November 2, 2026)
• CVE-2026-73696 record, VulnCheck's CNA entry, published November 2, 2026: https://www.cve.org/CVERecord?id=CVE-2026-73696 (checked November 2, 2026)
• CVE-2026-73695 record, VulnCheck's CNA entry, published November 2, 2026: https://www.cve.org/CVERecord?id=CVE-2026-73695 (checked November 2, 2026)
• CVE-2026-73697 record, VulnCheck's CNA entry, published November 2, 2026: https://www.cve.org/CVERecord?id=CVE-2026-73697 (checked November 2, 2026)
• Control Web Panel changelog, recording user-panel version 1.12 released September 8, 2026 and the release history through version 1.30 of October 31, 2026: https://control-webpanel.com/changelog (checked November 2, 2026)
• Control Web Panel homepage, stating more than 35,000 servers running CWP and 94,000 community members: https://control-webpanel.com/ (checked November 2, 2026)
• Control Web Panel demo page, documenting the user panel on port 2082 and the admin panel on port 2030: https://control-webpanel.com/demo (checked November 2, 2026)
• CISA Known Exploited Vulnerabilities catalog JSON feed, searched for all three CVEs with no match as of November 2, 2026: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json (checked November 2, 2026)