CVE-2026-71966

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643
https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/
https://www.vulncheck.com/advisories/cyberpanel-authenticated-command-injection-via-starremotetransfer

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) CyberPanel 2.4.3, corregida en el commit eca0c3c, contiene una vulnerabilidad de inyección de comandos autenticada en la función de transferencia de copia de seguridad remota que permite a atacantes autenticados ejecutar comandos arbitrarios del sistema operativo controlando la respuesta de la API de un servidor remoto. Los atacantes pueden inyectar comandos maliciosos a través de un nombre de directorio manipulado en la respuesta de la API del servidor remoto, lo que elude la validación del middleware de seguridad y se pasa sin sanear a la función de ejecución de comandos del sistema operativo.

Information

Published : 2026-08-10 20:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-71966

Mitre link : CVE-2026-71966

CVE.ORG link : CVE-2026-71966

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2026-71966", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-71966", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-14T19:28:09.684291Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"repo": "https://github.com/usmannasir/cyberpanel", "vendor": "usmannasir", "product": "cyberpanel", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.4.3"}, {"status": "unaffected", "version": "eca0c3cbeb35af8eaae9fafb094e8ef3cd923643", "versionType": "git"}], "packageURL": "pkg:github/usmannasir/cyberpanel", "defaultStatus": "affected"}]}], "published": "2026-08-10T20:17:32.723", "references": [{"url": "https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643", "source": "disclosure@vulncheck.com"}, {"url": "https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/cyberpanel-authenticated-command-injection-via-starremotetransfer", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function."}, {"lang": "es", "value": "CyberPanel 2.4.3, corregida en el commit eca0c3c, contiene una vulnerabilidad de inyecci\u00f3n de comandos autenticada en la funci\u00f3n de transferencia de copia de seguridad remota que permite a atacantes autenticados ejecutar comandos arbitrarios del sistema operativo controlando la respuesta de la API de un servidor remoto. Los atacantes pueden inyectar comandos maliciosos a trav\u00e9s de un nombre de directorio manipulado en la respuesta de la API del servidor remoto, lo que elude la validaci\u00f3n del middleware de seguridad y se pasa sin sanear a la funci\u00f3n de ejecuci\u00f3n de comandos del sistema operativo."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "disclosure@vulncheck.com"}