Home

Description

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

PUBLISHED Reserved 2026-02-01 | Published 2026-05-10 | Updated 2026-05-10 | Assigner VulnCheck




HIGH: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
HIGH: 8.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

Improper Link Resolution Before File Access ('Link Following')

Product status

<= 2.1
affected

Credits

Numan Türle finder

References

www.exploit-db.com/exploits/50230 (ExploitDB-50230) exploit

cyberpanel.net/ (Official Product Homepage) product

github.com/usmannasir/cyberpanel (Product Reference) product

www.vulncheck.com/...emote-code-execution-via-symlink-attack (VulnCheck Advisory: CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack) third-party-advisory

cve.org (CVE-2021-47949)

nvd.nist.gov (CVE-2021-47949)

Download JSON