CyberPanel EUVD-2026-55735

Exploitation requires a valid CyberPanel account at any privilege level capable of accessing the remote backup destination configuration-this includes reseller and standard user accounts, not only administrators. The remote backup feature is a standard CyberPanel capability present in version 2.4.3 by default; no non-default configuration is required to expose the vulnerable endpoints. The attacker must be able to reach the CyberPanel web interface over the network (typically TCP 8090 or 8443). In the SSH key injection variant, the attacker must also control or impersonate an SSH server reachable from the CyberPanel host. Exploitation is limited by the PR:L requirement: unauthenticated external attackers cannot exploit this without first obtaining CyberPanel credentials via phishing, credential stuffing, or other means. In multi-tenant shared hosting environments where clients routinely receive CyberPanel logins, this authentication barrier provides minimal protection and all tenant accounts should be treated as potential threat actors for patching prioritization.

The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the attack profile: remotely exploitable, low complexity, requiring only standard authenticated user access, with complete compromise of confidentiality, integrity, and availability on the vulnerable system. The publicly available proof-of-concept (themcsam.github.io) makes this trivially weaponizable-any attacker possessing CyberPanel credentials can follow the published steps. The impact is disproportionately severe relative to the PR:L barrier: root SSH access persists indefinitely via the authorized_keys backdoor, surviving CyberPanel account revocation or password changes. EPSS data is not present in the provided intelligence package, limiting probabilistic exploitation forecasting. No CISA KEV listing is confirmed at time of analysis, but the combination of low attack complexity, available exploit code, and full root compromise warrants immediate remediation priority for any internet-exposed CyberPanel instance. In shared or multi-tenant hosting environments where customers hold CyberPanel logins, the PR:L requirement is effectively nullified-any customer account becomes a path to full server compromise affecting all co-hosted tenants.

An attacker with a valid CyberPanel user account navigates to the remote backup destination creation interface and submits a crafted IP address field containing injected shell commands, or points the backup destination at an attacker-controlled SSH server that presents a fabricated public key during the connection test. CyberPanel's backup module processes the input without sanitization, executing the injected payload or writing the attacker's public key to /root/.ssh/authorized_keys as root. The attacker then authenticates directly to the host via SSH using the corresponding private key, obtaining a persistent interactive root shell; a publicly available proof-of-concept demonstrates this complete chain.