Cyberpanel
Monthly
CyberPanel versions before 3.0.0 expose a path traversal in the cloudAPI ReadReport endpoint that allows authenticated administrators to read any file accessible by the root-privileged CyberPanel process. The `reportFile` parameter in the JSON request body is passed without sanitization directly to Python's `open()` in `cloudManager.py`, enabling directory traversal to credential files, SSL and SSH private keys, and JWT secrets. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the vulnerability is straightforward to abuse given administrative credentials.
Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. No public exploit identified at time of analysis, but the trivial exploitation path (known secret, single forged token) makes reliable weaponization straightforward for any actor who reads the source.
Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. A publicly available proof-of-concept exploit exists per the researcher writeup at themcsam.github.io; the vendor has released a fix in commit eca0c3c.
Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level SSH access by exploiting command injection in the remote backup destination feature. The backup module concatenates user-controlled parameters-IP address, SSH port, username, and password-directly into OS-level shell commands without sanitization, and the SSH key retrieval process fails to verify host authenticity, enabling a malicious server to supply a public key that CyberPanel writes to /root/.ssh/authorized_keys. A publicly available proof-of-concept demonstrates the complete exploit chain; the vendor has released a fix in upstream commit eca0c3c, though no tagged release version has been independently confirmed.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worker endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) that ship without authentication checks (CWE-306). Because no credentials are required (CVSS 4.0 PR:N/UI:N), any attacker who can reach the panel can flood the database, corrupt scan-history records, and pollute stored fields, degrading integrity and availability. Publicly available exploit code exists and the flaw was reported by VulnCheck, though EPSS remains low at 0.21% and it is not listed in CISA KEV.
Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on versions prior to 2.4.4, exploitable by any network-reachable attacker without credentials. The POST /api/ai-scanner/callback endpoint lacks authentication, permitting arbitrary JavaScript injection into the findings_json field of ScanHistory records; when an administrator visits the AI Scanner dashboard, the script executes in their privileged browser session and issues same-origin API calls to plant OS-level cron jobs. A public proof-of-concept exploit is confirmed; no CISA KEV active exploitation listing is present at time of analysis, though the low skill requirement due to POC availability elevates real-world risk significantly.
CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in CyberPanel through 1.8.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
CyberPanel versions before 3.0.0 expose a path traversal in the cloudAPI ReadReport endpoint that allows authenticated administrators to read any file accessible by the root-privileged CyberPanel process. The `reportFile` parameter in the JSON request body is passed without sanitization directly to Python's `open()` in `cloudManager.py`, enabling directory traversal to credential files, SSL and SSH private keys, and JWT secrets. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the vulnerability is straightforward to abuse given administrative credentials.
Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. No public exploit identified at time of analysis, but the trivial exploitation path (known secret, single forged token) makes reliable weaponization straightforward for any actor who reads the source.
Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. A publicly available proof-of-concept exploit exists per the researcher writeup at themcsam.github.io; the vendor has released a fix in commit eca0c3c.
Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level SSH access by exploiting command injection in the remote backup destination feature. The backup module concatenates user-controlled parameters-IP address, SSH port, username, and password-directly into OS-level shell commands without sanitization, and the SSH key retrieval process fails to verify host authenticity, enabling a malicious server to supply a public key that CyberPanel writes to /root/.ssh/authorized_keys. A publicly available proof-of-concept demonstrates the complete exploit chain; the vendor has released a fix in upstream commit eca0c3c, though no tagged release version has been independently confirmed.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worker endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) that ship without authentication checks (CWE-306). Because no credentials are required (CVSS 4.0 PR:N/UI:N), any attacker who can reach the panel can flood the database, corrupt scan-history records, and pollute stored fields, degrading integrity and availability. Publicly available exploit code exists and the flaw was reported by VulnCheck, though EPSS remains low at 0.21% and it is not listed in CISA KEV.
Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on versions prior to 2.4.4, exploitable by any network-reachable attacker without credentials. The POST /api/ai-scanner/callback endpoint lacks authentication, permitting arbitrary JavaScript injection into the findings_json field of ScanHistory records; when an administrator visits the AI Scanner dashboard, the script executes in their privileged browser session and issues same-origin API calls to plant OS-level cron jobs. A public proof-of-concept exploit is confirmed; no CISA KEV active exploitation listing is present at time of analysis, though the low skill requirement due to POC availability elevates real-world risk significantly.
CyberPanel (aka Cyber Panel) before f0cf648 allows XSS via token or username to plogical/phpmyadminsignin.php. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation URI. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
CyberPanel (aka Cyber Panel) before 6778ad1 does not require the FilemanagerAdmin capability for restartMySQL actions. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An issue was discovered in CyberPanel through 1.8.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.