A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to… (CVE-2026-50979)

CVE-2026-50979 is a command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel versions 1.19.50 and earlier. It allows authenticated users to execute arbitrary shell commands via the 'url' parameter. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements used in a Command). The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, requiring privileges but no user interaction, and impacts confidentiality and integrity but not availability.

Successful exploitation allows an authenticated attacker to execute arbitrary shell commands on the affected system, potentially leading to compromise of confidentiality and integrity of the system. Availability impact is not indicated. This could enable attackers to manipulate system operations or access sensitive data.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the affected component to trusted users only and monitor for suspicious activity related to the 'url' parameter.