VulnCheck disclosed ten critical vulnerabilities in Control Web Panel (CWP), including an unauthenticated remote code execution (CVE-2026-73695) via a module path traversal combined with a missing exit() after a login redirect that allows execution of attacker-controlled PHP modules. This initial foothold lets attackers escalate to root through unauthenticated command injection and SQL injection flaws in the loopback user API, enabling full root access on affected servers; all issues are fixed in CWP 1.29 (October 31, 2026). Given tens of thousands of internet-facing installations expose the vulnerable user panel, operators must upgrade immediately to mitigate high-severity exploit paths actively demonstrated with public exploit tooling.
https://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce