CERT24CWP2Shell: Ten vulnerabilities including unauthenticated RCE
VulnCheck disclosed ten vulnerabilities in Control Web Panel. The most severe is CVE-2026-73695, an unauthenticated remote code execution vulnerability in the user panel. According to the source, the user-panel flaws can be combined with user API vulnerabilities to escalate from hosting-account privileges to root privileges. All ten vulnerabilities were fixed, according to the source, in CWP 1.29; version 1.30 is the current release.