CVE-2026-71964 is an arbitrary file read vulnerability in CyberPanel (up to version 2.4.3) caused by improper link resolution before file access in the file manager. The vulnerability arises because the application fails to validate symbolic links within uploaded ZIP archives before extraction. As a result, attackers with authentication can upload ZIP files containing symlinks that point outside the intended directory scope, enabling unauthorized reading of sensitive system files through the web interface. The vulnerability was addressed in a code commit identified as eca0c3c.

An authenticated attacker can read arbitrary files on the system by exploiting symbolic link handling in the file manager. This can lead to disclosure of sensitive system files outside the user's home directory. There is no indication of remote unauthenticated exploitation or privilege escalation. No known exploits in the wild have been reported.

A fix is available and was implemented in commit eca0c3c. Users should upgrade CyberPanel to a version that includes this fix (versions later than 2.4.3). Since the vendor advisory or patch links are not explicitly provided, users should verify the presence of this fix in their CyberPanel installation and apply the update accordingly. Patch status is not yet confirmed by an official vendor advisory; check the vendor's resources for current remediation guidance.