CVE-2026-35175

MediumCVSS 6.5

Published: 06/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

18th percentile - higher than 18% of all known CVEs

Summary

Ajenti before version 2.2.15 allows an authenticated user (using the auth_users plugin) to install a custom package even if not a superuser. This vulnerability is fixed in version 2.2.15.

Risk Assessment

An authenticated non-admin user could install a malicious package, leading to privilege escalation and potential server compromise.

Recommendation

Immediately upgrade Ajenti to version 2.2.15 or later.

Original NVD description (English source)

Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.