Osbil oPanel CVE-2026-50979

Exploitation requires a valid authenticated session in oPanel - any low-privileged user account with access to the 'advanced/curl' feature is sufficient (PR:L per CVSS). The vulnerable parameter is 'url' in the 'advanced/curl' component; if access to that specific feature is disabled or restricted by role, exploitation is prevented. No additional special configuration is needed beyond a default oPanel installation. Factors limiting exploitation: authentication is mandatory (unauthenticated attackers cannot reach the endpoint), and SSVC rates it as not automatable (the authentication step prevents mass-scale opportunistic exploitation). Availability impact is absent from the CVSS vector, indicating the injection does not directly cause denial of service, though arbitrary command execution could be used to cause one indirectly.

The CVSS 3.1 score of 8.1 (High) is appropriate given the network-reachable attack vector, low complexity, and high confidentiality and integrity impact. The requirement for prior authentication (PR:L) is the primary limiting factor distinguishing this from a critical unauthenticated RCE. SSVC signals reinforce a nuanced picture: Exploitation is rated 'none' (no confirmed active exploitation at time of analysis), Automatable is 'no' (the authentication step prevents mass automated targeting), yet Technical Impact is 'total' (a successful exploit yields full system access). A public proof-of-concept repository exists at github.com/bugresearch/CVE-2026-50979, which substantially lowers the skill bar for exploitation. EPSS data was not provided in the input; absence of KEV listing and SSVC 'Exploitation: none' together suggest opportunistic but not yet widespread exploitation. The realistic threat profile is a compromised or malicious low-privilege oPanel account leading to full server takeover - a significant risk for shared hosting environments where multiple tenants may hold panel credentials.

An attacker with a valid oPanel account - obtained through credential theft, brute force of a weak password, or a shared-hosting tenant account - navigates to the advanced/curl feature and submits a crafted value such as 'http://example.com; id > /tmp/out' in the url parameter. The server-side code passes this unsanitized string to a shell invocation, executing the injected command with the privileges of the web application process. A public proof-of-concept at github.com/bugresearch/CVE-2026-50979 documents this technique, meaning exploitation requires minimal attacker skill beyond valid credentials.