CyberPanel CVE-2026-41472

The initial injection step requires only network access to the CyberPanel web interface - no authentication, no special configuration, and no prior account on the system. The CVSS 4.0 vector confirms PR:N (no privileges required). The triggering condition for JavaScript execution and subsequent RCE requires a CyberPanel administrator to visit the AI Scanner dashboard after the payload is stored; without this passive admin interaction (CVSS 4.0 UI:P), the injected code does not execute. The cron job planting step requires that CyberPanel's cron management API remains accessible via same-origin authenticated requests from the admin browser session - a default condition in standard CyberPanel deployments. Exploitation is bounded by: (1) the admin must visit the specific AI Scanner dashboard page, not just any admin page; (2) the CyberPanel instance must be running a version prior to 2.4.4; (3) the AI Scanner feature must be present. Versions 2.4.4 and later enforce authentication on the callback endpoint, blocking the injection step entirely.

The official CVSS 4.0 score of 5.3 underrepresents practical risk because the scoring model separates vulnerable-system impact (VC:N/VI:N/VA:N) from subsequent-system impact (SC:H/SI:H), but operationally the end result is unauthenticated-to-OS-RCE gated only by passive admin interaction. SSVC rates Automatable: no, consistent with EPSS at 0.67% (71st percentile) - mass-scanning exploitation is constrained by the required admin dashboard visit, preventing bulk automated compromise. However, SSVC's Technical Impact rating of 'partial' is misleading: successful exploitation achieves full OS command execution via cron implantation, which is total impact in practice. A confirmed public POC at itsrez.re significantly lowers attacker skill requirements. The vulnerability is not in CISA KEV, so active in-the-wild exploitation is not formally confirmed; however, CyberPanel has a documented history of prior critical vulnerabilities being rapidly weaponized (e.g., CVE-2024-51567). Defenders should treat this as a high-priority patch given the public POC, the unauthenticated injection step, and the RCE chain outcome - the CVSS 4.0 score alone is an insufficient triage signal here.

An attacker sends an unauthenticated HTTP POST to /api/ai-scanner/callback on an internet-exposed CyberPanel instance, supplying a findings_json value containing a JavaScript payload that exfiltrates the admin's session token and issues a same-origin API call to create a cron job executing a reverse shell. When a CyberPanel administrator next opens the AI Scanner dashboard - a routine operational task - the stored script fires silently in their browser, the cron job is planted, and the attacker receives an OS-level shell on the server within minutes. A full proof-of-concept demonstrating this chain is publicly available at https://itsrez.re/post/cyberpanel-rce.