CVE-2021-47949

Description

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://cyberpanel.net/
• https://github.com/usmannasir/cyberpanel
• https://www.exploit-db.com/exploits/50230
• https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack

CWEs

CWE-59