Skip to main content

CyberPanel EUVDEUVD-2026-55735

| CVE-2026-71965 HIGH
Insufficient Verification of Data Authenticity (CWE-345)
2026-08-10 VulnCheck GHSA-5hg3-c77v-8mxm
RCE Cyberpanel
8.7
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
8.7 HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
9.9 CRITICAL

Network vector confirmed; PR:L reflects required authentication; S:C applies because exploitation crosses from web application context into root host OS access via SSH.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Aug 10, 2026 - 19:47 vuln.today
Analysis Generated
Aug 10, 2026 - 19:47 vuln.today
CVE Published
Aug 10, 2026 - 18:52 cve.org
HIGH 8.7

DescriptionCVE.org

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system.

AnalysisAI

Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level SSH access by exploiting command injection in the remote backup destination feature. The backup module concatenates user-controlled parameters-IP address, SSH port, username, and password-directly into OS-level shell commands without sanitization, and the SSH key retrieval process fails to verify host authenticity, enabling a malicious server to supply a public key that CyberPanel writes to /root/.ssh/authorized_keys. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain valid CyberPanel user credentials
Delivery
Navigate to remote backup destination configuration
Exploit
Submit malicious server address with injected shell payload or attacker-controlled SSH server
Install
CyberPanel executes unsanitized command as root
C2
Injected command or unverified key exchange writes attacker SSH public key to /root/.ssh/authorized_keys
Execute
Authenticate to host via SSH using matching private key
Impact
Persistent root shell on compromised host
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid CyberPanel account at any privilege level capable of accessing the remote backup destination configuration-this includes reseller and standard user accounts, not only administrators. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) accurately captures the attack profile: remotely exploitable, low complexity, requiring only standard authenticated user access, with complete compromise of confidentiality, integrity, and availability on the vulnerable system. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a valid CyberPanel user account navigates to the remote backup destination creation interface and submits a crafted IP address field containing injected shell commands, or points the backup destination at an attacker-controlled SSH server that presents a fabricated public key during the connection test. CyberPanel's backup module processes the input without sanitization, executing the injected payload or writing the attacker's public key to /root/.ssh/authorized_keys as root. …
Remediation Upstream fix available (PR/commit eca0c3c); a released tagged version incorporating this patch is not independently confirmed in the available intelligence-administrators must verify which tagged release includes commit eca0c3cbeb35af8eaae9fafb094e8ef3cd923643 by checking https://github.com/usmannasir/cyberpanel before upgrading. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all systems running CyberPanel 2.4.3 and immediately restrict backup feature access via role-based controls; deploy the vendor patch available in upstream commit eca0c3c or upgrade to a confirmed release version when available. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Cyberpanel

View all
CVE-2024-51378 CRITICAL POC
9.8 Oct 29

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers t
CVE-2024-51567 CRITICAL POC
9.8 Oct 29

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypas
CVE-2024-51568 CRITICAL POC
9.8 Oct 29

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecut
CVE-2026-71966 HIGH POC
8.7 Aug 10

Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to exec
CVE-2026-41473 HIGH POC
8.8 Apr 24

Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worke
CVE-2024-53376 HIGH POC
8.8 Dec 16

CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the

CVE-2019-13056 HIGH POC
8.8 Jul 02

An issue was discovered in CyberPanel through 1.8.4. Rated high severity (CVSS 8.8), this vulnerability is remotely expl
CVE-2021-47949 HIGH POC
8.7 May 10

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files an
CVE-2026-71964 HIGH POC
7.1 Aug 10

Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory s
CVE-2024-54679 MEDIUM POC
6.5 Dec 05

CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. R
CVE-2026-41472 MEDIUM POC
5.3 Apr 24

Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on vers
CVE-2026-67614 CRITICAL
9.3 Aug 13

Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the We

Same weakness CWE-345 – Insufficient Verification of Data Authenticity

View all
CVE-2023-38831 HIGH POC
7.8
CVE-2016-4553 HIGH
8.6
CVE-2016-4554 HIGH
8.6
CVE-2014-4936 CRITICAL POC
9.3
CVE-2025-66255 CRITICAL POC
9.9
CVE-2025-1945 CRITICAL POC
9.8
CVE-2024-11666 CRITICAL POC
9.8
CVE-2024-1554 CRITICAL POC
9.8

Same technique RCE

View all
CVE-2021-44228 CRITICAL POC
10.0
CVE-2017-7269 CRITICAL POC
9.8
CVE-2022-47966 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2023-3519 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8

Share

EUVD-2026-55735 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy