CVE-2026-71964

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643
https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/
https://www.vulncheck.com/advisories/cyberpanel-arbitrary-file-read-via-file-manager-zip-upload

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) CyberPanel 2.4.3, corregido en el commit eca0c3c, contiene una vulnerabilidad de lectura arbitraria de archivos en el componente de gestión de archivos que permite a atacantes autenticados leer archivos sensibles del sistema al subir un archivo ZIP manipulado que contiene enlaces simbólicos. Los atacantes pueden explotar la falla de la aplicación al validar enlaces simbólicos antes de la extracción, lo que provoca que los enlaces simbólicos que apuntan a rutas arbitrarias del sistema de archivos fuera del directorio de inicio del usuario persistan en el disco y sean accedidos a través de la interfaz web.

Information

Published : 2026-08-10 19:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71964

Mitre link : CVE-2026-71964

CVE.ORG link : CVE-2026-71964

JSON object : View

Products Affected

No product.

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

{"id": "CVE-2026-71964", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71964", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T14:39:26.080784Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/usmannasir/cyberpanel", "vendor": "usmannasir", "product": "cyberpanel", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.3"}, {"status": "unaffected", "version": "eca0c3cbeb35af8eaae9fafb094e8ef3cd923643", "versionType": "git"}], "packageURL": "pkg:github/usmannasir/cyberpanel", "defaultStatus": "affected"}]}], "published": "2026-08-10T19:17:31.613", "references": [{"url": "https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643", "source": "disclosure@vulncheck.com"}, {"url": "https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cyberpanel-arbitrary-file-read-via-file-manager-zip-upload", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-59"}]}], "descriptions": [{"lang": "en", "value": "CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface."}, {"lang": "es", "value": "CyberPanel 2.4.3, corregido en el commit eca0c3c, contiene una vulnerabilidad de lectura arbitraria de archivos en el componente de gesti\u00f3n de archivos que permite a atacantes autenticados leer archivos sensibles del sistema al subir un archivo ZIP manipulado que contiene enlaces simb\u00f3licos. Los atacantes pueden explotar la falla de la aplicaci\u00f3n al validar enlaces simb\u00f3licos antes de la extracci\u00f3n, lo que provoca que los enlaces simb\u00f3licos que apuntan a rutas arbitrarias del sistema de archivos fuera del directorio de inicio del usuario persistan en el disco y sean accedidos a trav\u00e9s de la interfaz web."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}