Description

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T20:17:32.580Z",
  "pubdate": "2026-08-10T20:17:32.580Z",
  "executiveSummary": "CyberPanel version 2.4.3 contains an authenticated remote code execution vulnerability residing within the remote backup feature.\nThe vulnerability allows authenticated attackers to gain persistent root-level SSH access to the underlying host system by supplying a malicious remote server address.\nBy exploiting the unverified SSH public key retrieval process, an attacker can coerce the application into writing an attacker-controlled public key directly into the /root/.ssh/authorized_keys file.\nThis flaw presents severe risk implications, as successful exploitation results in total system compromise with root privileges.\nThe attack requires authentication and leverages the remote backup functionality to execute arbitrary public key injection without proper input validation or integrity checks during the SSH public key retrieval phase.",
  "technicalDetails": "The root cause of the vulnerability stems from improper handling and lack of validation within the remote backup feature when interacting with external servers to retrieve SSH public keys.\nThe vulnerable component is the remote backup module of CyberPanel version 2.4.3, specifically the routine responsible for fetching and handling SSH public keys from specified remote server addresses.\nExploitation requires valid user authentication within the application, but leverages the privileged nature of the backend process to interact with system-level SSH configurations.\nThe attack flow proceeds as follows: an authenticated attacker navigates to or interacts with the remote backup functionality and supplies a crafted, malicious remote server address under their control.\nThe application initiates a connection or key retrieval process targeting the attacker-supplied address, relying on an unverified SSH public key retrieval mechanism.\nDue to the absence of proper sanitization, validation, and verification of the retrieved data or the remote endpoint, the application accepts the arbitrary public key provided by the attacker-controlled server.\nThe payload behavior involves writing this attacker-controlled public key directly into the critical system file located at /root/.ssh/authorized_keys.\nPost-exploitation impact is catastrophic, as the insertion of the unauthorized public key grants the attacker immediate, persistent root-level SSH access to the host system, bypassing standard authorization boundaries and enabling full administrative control over the affected infrastructure."
}