Threat Intelligence Database

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain's home directory, the application returns the contents of files readable by the CyberPanel execution identity.

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

CyberPanel versions prior to 2.4.4 contain a flaw in how they detect alias domains. Instead of using a proper Python conditional statement, the detection relies on an ORM query filter, which may lead to incorrect identification of alias domains.

CyberPanel versions before 3.0.5 have an improper authentication vulnerability where two-factor authentication (2FA) is not enforced on API endpoints. This allows attackers who have obtained an administrator's password to bypass the Time-based One-Time Password (TOTP) requirement by deriving API tokens from the password. Consequently, attackers can perform administrative actions or create authenticated sessions without needing the second authentication factor.

CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.

CyberPanel versions prior to 3.0.0 contain a path traversal vulnerability in the cloudAPI ReadReport endpoint. Authenticated administrators can exploit this flaw by supplying unsanitized file paths, allowing them to read arbitrary files on the server filesystem. This includes sensitive files such as credential files, SSL and SSH private keys, and JWT secret files. The vulnerability arises because the reportFile parameter is passed directly to the open() function without validation or allowlisting. The CVSS 4.0 base score is 6.9, indicating a medium severity issue.

CyberPanel versions prior to 3.0.0 contain a critical vulnerability due to a hard-coded JWT secret in the WebTerminal FastAPI SSH service. This flaw allows unauthenticated remote attackers to forge valid JWT authentication tokens, specifying ssh_user=root, to gain an interactive root shell via WebSocket on port 8888 without valid credentials.

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system.