CVE-2026-73697: modules/phpini_editor.php file_put_contents + shell_exec sinks
Arbitrary file write and command injection in the CWP phpini_editor module. Modules trust the dispatcher auth gate; when that gate is bypassed the sinks are exposed without a session. Primary foothold used in VulnCheck's public exploit.
Executive Summary & Technical Impact
Arbitrary file write and command injection in the CWP phpini_editor module. Modules trust the dispatcher auth gate; when that gate is bypassed the sinks are exposed without a session. Primary foothold used in VulnCheck's public exploit.
Tracked under CVE-2026-73697 (CWE-22 / CWE-98 + CWE-78), this vulnerability affects CWP before 1.16 and carries a severity score of 9.8 (CRITICAL). Engineering and security operations teams running Control Web Panel (CWP) phpini_editor module should prioritize upgrading to CWP 1.16+ (get_user_safe_path; rm -f shell_exec removed); full chain 1.29+.
Remediation & Patch Guidance
- Upgrade to CWP 1.29 or later.
- Monitor for anonymous POSTs to phpini_editor acc=update / acc=addlabelphpiniadv on port 2083.
Frequently Asked Questions (CVE-2026-73697)
What versions are affected by CVE-2026-73697?
CVE-2026-73697 affects CWP before 1.16 in Control Web Panel (CWP) phpini_editor module (modules/phpini_editor.php file_put_contents + shell_exec sinks).
How do I patch or remediate CVE-2026-73697?
Upgrade affected deployments to CWP 1.16+ (get_user_safe_path; rm -f shell_exec removed); full chain 1.29+ and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-73697?
CVE-2026-73697 is rated CRITICAL with a CVSS score of 9.8 (vector: Network; reachable pre-auth when chained with CVE-2026-73695/73696; runs as hosting user).
