CVE-2026-73695: services/users/index.php module parameter include

Executive Summary & Technical Impact

Unauthenticated local file inclusion via path traversal in the CWP user-panel module parameter. Combined with the missing exit() after the login redirect (CVE-2026-73696) and ungated module sinks, this is the front door of the CWP2Shell unauthenticated-to-root chain disclosed by VulnCheck on Nov 3, 2026. A public go-exploit module exists.

Tracked under CVE-2026-73695 (CWE-98 (Improper Control of Filename for Include/Require Statement)), this vulnerability affects CWP before 1.16 (pre-auth entry also requires builds before 1.12 for CVE-2026-73696) and carries a severity score of 9.8 (stage score, VulnCheck) (CRITICAL). Engineering and security operations teams running Control Web Panel (CWP) user panel should prioritize upgrading to CWP 1.29 or later (1.30 current); module name sanitized in 1.16.

Remediation & Patch Guidance

1. Upgrade CWP to 1.29 or later (1.30 is current as of Nov 3, 2026).
2. Take user panel port 2083 and admin ports 2031/2087 off the public internet.
3. Hunt for unexpected /tmp PHP files and loopback traffic to 127.0.0.1:2302 from hosting accounts.

Frequently Asked Questions (CVE-2026-73695)

What versions are affected by CVE-2026-73695?

CVE-2026-73695 affects CWP before 1.16 (pre-auth entry also requires builds before 1.12 for CVE-2026-73696) in Control Web Panel (CWP) user panel (services/users/index.php module parameter include).

How do I patch or remediate CVE-2026-73695?

Upgrade affected deployments to CWP 1.29 or later (1.30 current); module name sanitized in 1.16 and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-73695?

CVE-2026-73695 is rated CRITICAL with a CVSS score of 9.8 (stage score, VulnCheck) (vector: Network, unauthenticated via port 2083; path traversal in module= reaches arbitrary local .php; chained with EAR and module sinks for pre-auth RCE).