CVE-2026-71966
HighCVSS 8.8Exploitation Probability (EPSS)
High risk80th percentile - higher than 80% of all known CVEs
Summary
CyberPanel 2.4.3 contains an authenticated command injection vulnerability in the remote backup transfer feature. Attackers can control a remote server's API response and inject malicious commands via a crafted directory name, which bypasses security middleware and is passed unsanitized to the OS command execution function.
Risk Assessment
An authenticated attacker can execute arbitrary system commands on the server, potentially leading to full system compromise.
Recommendation
Apply the fix from commit eca0c3c or update CyberPanel to a patched version.
Original NVD description (English source)
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.