The vulnerability exists in the getresetstatus functions within dns/views.py and ftp/views.py in CyberPanel before commit 1c0c6cb. Attackers can bypass the secMiddleware authentication, which only applies to POST requests, by sending requests to /dns/getresetstatus or /ftp/getresetstatus using other HTTP methods. By injecting shell metacharacters into the statusfile parameter, attackers can execute arbitrary commands on the server. This vulnerability is tracked as CVE-2024-51378 and has a CVSS 3.1 base score of 10.0, indicating critical severity. Versions through 2.3.6 and the unpatched 2.3.7 are affected. No official patch or remediation link is provided in the data.

Successful exploitation allows unauthenticated remote attackers to bypass authentication controls and execute arbitrary commands on the affected CyberPanel server. This can lead to full system compromise, data loss, and disruption of services. The vulnerability is critical with a CVSS score of 10.0, reflecting high attack complexity, no required privileges, no user interaction, and complete confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor CyberPanel vendor communications for updates. As a temporary mitigation, restrict access to the /dns/getresetstatus and /ftp/getresetstatus endpoints, and avoid exposing CyberPanel management interfaces to untrusted networks until a fix is available.