CVE-2026-50979

HighCVSS 8.1

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.43%

71th percentile - higher than 71% of all known CVEs

Summary

A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter.

Risk Assessment

The risk is that an authenticated attacker can execute arbitrary commands on the server, potentially leading to full system compromise or data breach.

Recommendation

Update to a non-vulnerable version and validate/sanitize the 'url' parameter before use.

Other vulnerabilities in oPanel

CVE-2026-50980Low risk· EPSS 30%
A Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before version 1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record.

Original NVD description (English source)