Read the docs
TI-2021-22562 Aliases CVE-2021-47949GHSA-47jc-h939-7pj5

CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack

Priority HIGH 73CWE-59Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00533 45th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CyberPanelCyberPanelup to 2.1—No fix listedCNA
  • CyberPanel VendorCyberPanel Affected up to 2.1 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-47949
  2. 2026-10-03 Alias added: GHSA-47jc-h939-7pj5

References

Exploit 1

Other 2

  • TI-2024-34482 upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6… KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-34345 getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before… KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-30062 CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints CVSS 4.0HIGH 8.8
  • TI-2024-34483 CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in… CVSS 3.1CRITICAL 10.0
  • TI-2024-35785 CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands… CVSS 3.1HIGH 8.8
  • TI-2026-30061 CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard CVSS 4.0MEDIUM 5.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences