Cyberpanel Cyberpanel vulnerabilities

CVE-2026-29812 Medium · 4.3 CWE-778 Sep 13, 2026

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the…

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CVE-2026-29811 High · 7.7 CWE-1025 Sep 13, 2026

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that…

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CVE-2026-29810 Medium · 4.3 CWE-390 Sep 13, 2026

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

CVE-2021-47949 High · 8.8 CWE-59 May 10, 2026

CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

CVE-2026-41473 Critical · 9.1 CWE-306 Apr 24, 2026

CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the database by sending requests to the /api/ai-scanner/status-webhook and /api/ai-scanner/callback endpoints. Attackers can exploit the lack of authentication checks to cause denial of service through storage exhaustion, corrupt scan history records, and pollute database fields with malicious data.

CVE-2026-41472 Medium · 6.1 CWE-79 Apr 24, 2026

CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

CVE-2024-51567 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-306 Oct 29, 2024

CyberPanel Incorrect Default Permissions Vulnerability

upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.

CVE-2024-51378 Critical · 9.8 KEV Urgent · 93 Public exploit Ransomware CWE-78 Oct 29, 2024

CyberPanel Incorrect Default Permissions Vulnerability

getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.