Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php

Summary

Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no allowlist, basename(), or traversal sanitization. An attacker can supply directory traversal sequences in the module name to include arbitrary local .php files, resulting in local PHP file inclusion.

Remediation

1. Inventory every Control Web Panel Control Web Panel deployment, including staging.
2. Upgrade Control Web Panel Control Web Panel to 1.16.
3. Confirm the running version after the upgrade.

References

• Patchhttps://control-webpanel.com/changelog
• Advisoryhttps://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-via-services-users-index-php
• Referencehttps://www.vulncheck.com/advisories/control-web-panel-cwp-path-traversal-lfi-via-module-parameter
• Referencehttps://www.vulncheck.com/blog/control-web-panel-pre-auth-module-dispatch-rce