Description

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-10T19:17:31.613Z",
  "pubdate": "2026-08-10T19:17:31.613Z",
  "executiveSummary": "CyberPanel version 2.4.3 contains an arbitrary file read vulnerability located within the file manager component. This security flaw allows authenticated attackers with access to the file manager to read sensitive system files residing outside the intended user home directory scope.\nThe vulnerability arises due to the application's failure to adequately validate and sanitize symbolic links contained within uploaded archives prior to extraction. Consequently, malicious actors can leverage this oversight to compromise confidentiality by exposing restricted filesystem resources through the web interface.\nSuccessful exploitation requires authentication and the ability to interact with the file manager component to upload and extract a specially crafted ZIP archive. The risk implication involves unauthorized information disclosure, potentially exposing critical system credentials, configuration files, or sensitive operating system data to malicious users.",
  "technicalDetails": "The vulnerability resides in the file manager component of CyberPanel version 2.4.3, specifically within the archive extraction routine. The root cause is the insufficient input validation and sanitization of symbolic links embedded within uploaded ZIP archives. When an attacker uploads a crafted ZIP archive containing symbolic links targeting arbitrary filesystem paths outside the user's home directory, the application extracts and persists these symlinks directly to the disk without checking their destination targets.\nExploitation requires an attacker to possess valid authentication credentials and access to the file manager component. The attack flow begins with the creation of a malicious ZIP archive containing symbolic links that point to sensitive system files residing outside the restricted directory boundaries. The attacker then uploads this archive via the file manager interface and triggers the extraction process.\nBecause the application fails to validate the symlink targets, the malicious symbolic links are successfully written to the underlying filesystem. Once persisted, the attacker can leverage the web interface to traverse and access the targets of these symbolic links, resulting in arbitrary file read capabilities. The impact of this post-exploitation phase includes the unauthorized disclosure of sensitive system data, configuration parameters, or internal application secrets accessible via the web server context.\nThis vulnerability affects CyberPanel version 2.4.3 and has been addressed in commit eca0c3c. The network exposure is tied to the accessibility of the CyberPanel web interface, and the exploit relies upon authenticated session access combined with standard file management privileges."
}