Description

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T20:17:32.723Z",
  "pubdate": "2026-08-10T20:17:32.723Z",
  "executiveSummary": "CyberPanel version 2.4.3 contains an authenticated command injection vulnerability residing within the remote backup transfer feature. This security flaw enables authenticated remote attackers to execute arbitrary operating system commands with the privileges of the underlying application. The vulnerability impacts CyberPanel 2.4.3 and is successfully remediated in commit eca0c3c.\nThe risk implication is severe, as successful exploitation grants the attacker arbitrary command execution capabilities on the host operating system, potentially leading to total system compromise, data exfiltration, and lateral movement within the network. Exploitation requires the attacker to possess authenticated access to the application and the ability to control or manipulate a remote server's API response interacting with the backup transfer mechanism.",
  "technicalDetails": "The vulnerability is caused by improper neutralization of special elements used in an operating system command, commonly known as command injection. The vulnerable component is the remote backup transfer feature within CyberPanel 2.4.3. Specifically, the flaw exists because security middleware validation is bypassed when processing data received from a remote server's API response.\nThe attack flow proceeds as follows: an authenticated attacker establishes interaction with the remote backup transfer functionality. During the transfer process, the application queries a remote server and receives an API response containing directory listings or metadata. The attacker crafts a malicious directory name within this remote server's API response, embedding arbitrary operating system command payloads.\nBecause the security middleware validation fails to properly sanitize or validate the directory name returned by the external API, the crafted input is passed completely unsanitized directly to the underlying operating system command execution function. When the application processes the backup transfer and evaluates the directory structure, the injected commands are executed by the OS shell.\nThe vulnerability requires authentication to access the backup transfer feature. The network exposure is tied to the CyberPanel administration interface or API endpoints handling remote backup operations. Post-exploitation impact includes full system compromise, unauthorized execution of administrative OS commands, data tampering, and potential access to sensitive server configurations."
}