CyberPanel EUVD-2026-55734

The attacker must hold a valid CyberPanel user account at any privilege level (PR:L); unauthenticated exploitation is not possible. The file manager component must be accessible to the attacker's account tier - on shared hosting panels this is typically the default for all reseller and end-user accounts. No special server configuration is required beyond standard CyberPanel 2.4.3 deployment. Exploitation is limited to reading files that the web server process user has permission to follow via symlink; on systems where AppArmor, SELinux, or filesystem ACLs restrict the web server user's read scope, impact may be reduced. Files outside the web root are accessible only if the web server follows symlinks across directory boundaries, which is common in default CyberPanel configurations. No user interaction, social engineering, or additional prerequisites are required beyond the authenticated upload step.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) correctly reflects a network-reachable, low-complexity flaw requiring only a valid panel account, with no integrity or availability impact - a read-only confidentiality breach. The score of 7.1 is proportionate: the PR:L requirement is a meaningful gate, preventing anonymous exploitation, but on shared hosting panels low-privilege accounts are routinely provisioned to dozens or hundreds of tenants, making the realistic attacker pool large. A publicly available exploit (themcsam GitHub post) raises practical exploitability above the theoretical; defenders cannot treat this as proof-of-concept-only. No EPSS data was provided and no CISA KEV entry exists, so there is no confirmed signal of mass automated exploitation. The absence of integrity and availability impact means this vulnerability is a stepping stone - enabling credential theft or SSH key exfiltration - rather than a direct path to remote code execution. CVSS signals and description are internally consistent and do not conflict. The vendor patch (commit eca0c3c) is available, making the remediation path clear. Note: the provided commit diff covers command injection fixes in backupManager.py, not the symlink extraction logic; the actual symlink fix is likely in a separate file manager module not shown in the diff - see confidence notes.

An attacker with a low-privilege CyberPanel hosting account navigates to the file manager, crafts a ZIP archive containing a symlink entry named shadow.txt pointing to /etc/shadow, and uploads it. The panel extracts the archive without symlink validation, planting the link in the attacker's web-accessible directory. The attacker then fetches the link via a direct URL, receiving the contents of /etc/shadow and enabling offline password cracking. A public exploit demonstrating this technique is available at https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/.