Threat Intelligence Database

CyberPanel versions prior to 3.0.0 contain a critical vulnerability due to a hard-coded JWT secret in the WebTerminal FastAPI SSH service. This flaw allows unauthenticated remote attackers to forge valid JWT authentication tokens, specifying ssh_user=root, to gain an interactive root shell via WebSocket on port 8888 without valid credentials.

CyberPanel versions prior to 3.0.0 contain a path traversal vulnerability in the cloudAPI ReadReport endpoint. Authenticated administrators can exploit this flaw by supplying unsanitized file paths, allowing them to read arbitrary files on the server filesystem. This includes sensitive files such as credential files, SSL and SSH private keys, and JWT secret files. The vulnerability arises because the reportFile parameter is passed directly to the open() function without validation or allowlisting. The CVSS 4.0 base score is 6.9, indicating a medium severity issue.

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system.

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.