CVE-2021-47949 - Vulnerability Analysis

Overview

CyberPanel 2.1 contains a command injection caused by symlink attacks via the filemanager controller endpoint, letting authenticated attackers read arbitrary files and execute remote code, exploit requires authentication.

Severity & Score

Impact

Authenticated attackers can read sensitive files and execute arbitrary code, leading to full system compromise.

Mitigation

Update to the latest CyberPanel version.

References

• https://cyberpanel.net/
• https://github.com/usmannasir/cyberpanel
• https://www.exploit-db.com/exploits/50230
• https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner