Usmannasir
Monthly
CyberPanel before 3.0.5 allows attackers who have obtained an administrator's password to bypass two-factor authentication entirely on API endpoints by deriving valid API tokens from the password alone, without satisfying the TOTP requirement. This reduces 2FA-protected admin accounts to effective single-factor authentication at the API layer, enabling full administrative operations or session creation. The fix is available in version 3.0.5 per the GitHub security advisory; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. No public exploit identified at time of analysis, but the trivial exploitation path (known secret, single forged token) makes reliable weaponization straightforward for any actor who reads the source.
Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. A publicly available proof-of-concept exploit exists per the researcher writeup at themcsam.github.io; the vendor has released a fix in commit eca0c3c.
Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level SSH access by exploiting command injection in the remote backup destination feature. The backup module concatenates user-controlled parameters-IP address, SSH port, username, and password-directly into OS-level shell commands without sanitization, and the SSH key retrieval process fails to verify host authenticity, enabling a malicious server to supply a public key that CyberPanel writes to /root/.ssh/authorized_keys. A publicly available proof-of-concept demonstrates the complete exploit chain; the vendor has released a fix in upstream commit eca0c3c, though no tagged release version has been independently confirmed.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worker endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) that ship without authentication checks (CWE-306). Because no credentials are required (CVSS 4.0 PR:N/UI:N), any attacker who can reach the panel can flood the database, corrupt scan-history records, and pollute stored fields, degrading integrity and availability. Publicly available exploit code exists and the flaw was reported by VulnCheck, though EPSS remains low at 0.21% and it is not listed in CISA KEV.
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner callback and status-update endpoints that return administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata without requiring any credentials. Unauthenticated network attackers can systematically enumerate panel administrators and recent scanner activity across multi-tenant hosting installations, enabling reconnaissance for follow-on credential attacks or phishing. No public exploit code has been identified at time of analysis; vendor-released patch version 2.4.6 is available.
CyberPanel versions before 3.0.0 expose a path traversal in the cloudAPI ReadReport endpoint that allows authenticated administrators to read any file accessible by the root-privileged CyberPanel process. The `reportFile` parameter in the JSON request body is passed without sanitization directly to Python's `open()` in `cloudManager.py`, enabling directory traversal to credential files, SSL and SSH private keys, and JWT secrets. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the vulnerability is straightforward to abuse given administrative credentials.
Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on versions prior to 2.4.4, exploitable by any network-reachable attacker without credentials. The POST /api/ai-scanner/callback endpoint lacks authentication, permitting arbitrary JavaScript injection into the findings_json field of ScanHistory records; when an administrator visits the AI Scanner dashboard, the script executes in their privileged browser session and issues same-origin API calls to plant OS-level cron jobs. A public proof-of-concept exploit is confirmed; no CISA KEV active exploitation listing is present at time of analysis, though the low skill requirement due to POC availability elevates real-world risk significantly.
CyberPanel before 3.0.5 allows attackers who have obtained an administrator's password to bypass two-factor authentication entirely on API endpoints by deriving valid API tokens from the password alone, without satisfying the TOTP requirement. This reduces 2FA-protected admin accounts to effective single-factor authentication at the API layer, enabling full administrative operations or session creation. The fix is available in version 3.0.5 per the GitHub security advisory; no public exploit or active exploitation has been identified at time of analysis.
Unauthenticated remote root compromise affects CyberPanel before 3.0.0 through a hard-coded JWT signing secret in the WebTerminal FastAPI SSH service. Because the secret is baked into the code, an attacker can mint a valid token specifying ssh_user=root and connect to the WebSocket terminal on TCP 8888 with no credentials, receiving a fully interactive root shell. No public exploit identified at time of analysis, but the trivial exploitation path (known secret, single forged token) makes reliable weaponization straightforward for any actor who reads the source.
Command injection in CyberPanel 2.4.3's remote backup transfer feature allows authenticated low-privileged users to execute arbitrary OS commands on the host by manipulating the API response of a remote backup server they control. The vulnerability exists in backupManager.py, where the backupDir value returned by the remote server is concatenated unsanitized into shell command strings, bypassing ACLManager middleware validation entirely. A publicly available proof-of-concept exploit exists per the researcher writeup at themcsam.github.io; the vendor has released a fix in commit eca0c3c.
Authenticated remote code execution in CyberPanel 2.4.3 allows any logged-in user to escalate to persistent root-level SSH access by exploiting command injection in the remote backup destination feature. The backup module concatenates user-controlled parameters-IP address, SSH port, username, and password-directly into OS-level shell commands without sanitization, and the SSH key retrieval process fails to verify host authenticity, enabling a malicious server to supply a public key that CyberPanel writes to /root/.ssh/authorized_keys. A publicly available proof-of-concept demonstrates the complete exploit chain; the vendor has released a fix in upstream commit eca0c3c, though no tagged release version has been independently confirmed.
Arbitrary file read in CyberPanel 2.4.3's file manager allows authenticated panel users to escape their home-directory sandbox by uploading a crafted ZIP archive containing symbolic links that target arbitrary filesystem paths. The application extracts ZIP contents without validating whether entries are symlinks, causing those links to persist on disk and remain accessible through the web interface, enabling retrieval of sensitive files such as /etc/shadow or SSH private keys. A publicly available exploit exists and a vendor patch is available at commit eca0c3c; no CISA KEV listing has been identified, but the low authentication barrier makes this a credible privilege escalation vector on any multi-tenant CyberPanel instance.
Unauthenticated database writes in CyberPanel versions before 2.4.4 allow remote attackers to abuse two AI Scanner worker endpoints (/api/ai-scanner/status-webhook and /api/ai-scanner/callback) that ship without authentication checks (CWE-306). Because no credentials are required (CVSS 4.0 PR:N/UI:N), any attacker who can reach the panel can flood the database, corrupt scan-history records, and pollute stored fields, degrading integrity and availability. Publicly available exploit code exists and the flaw was reported by VulnCheck, though EPSS remains low at 0.21% and it is not listed in CISA KEV.
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner callback and status-update endpoints that return administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata without requiring any credentials. Unauthenticated network attackers can systematically enumerate panel administrators and recent scanner activity across multi-tenant hosting installations, enabling reconnaissance for follow-on credential attacks or phishing. No public exploit code has been identified at time of analysis; vendor-released patch version 2.4.6 is available.
CyberPanel versions before 3.0.0 expose a path traversal in the cloudAPI ReadReport endpoint that allows authenticated administrators to read any file accessible by the root-privileged CyberPanel process. The `reportFile` parameter in the JSON request body is passed without sanitization directly to Python's `open()` in `cloudManager.py`, enabling directory traversal to credential files, SSL and SSH private keys, and JWT secrets. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis, though the vulnerability is straightforward to abuse given administrative credentials.
Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on versions prior to 2.4.4, exploitable by any network-reachable attacker without credentials. The POST /api/ai-scanner/callback endpoint lacks authentication, permitting arbitrary JavaScript injection into the findings_json field of ScanHistory records; when an administrator visits the AI Scanner dashboard, the script executes in their privileged browser session and issues same-origin API calls to plant OS-level cron jobs. A public proof-of-concept exploit is confirmed; no CISA KEV active exploitation listing is present at time of analysis, though the low skill requirement due to POC availability elevates real-world risk significantly.