CVE-2024-51568

Deeper analysis

CyberPanel versions prior to 2.3.5 contain a command injection vulnerability in the ProcessUtilities.outputExecutioner() sink when handling the completePath parameter. The flaw is exposed through the unauthenticated /filemanager/upload endpoint and permits arbitrary command execution via shell metacharacters, corresponding to CWE-78. The issue received a CVSS 3.1 score of 10.0, reflecting network-accessible exploitation without credentials or user interaction and full compromise of confidentiality, integrity, and availability in the affected scope.

An unauthenticated remote attacker can submit a malicious upload request containing shell metacharacters to achieve unauthenticated remote code execution on the CyberPanel host. Successful exploitation grants the attacker the ability to run arbitrary operating-system commands with the privileges of the web-server process, enabling full system takeover.

Vendor change logs and the CyberPanel 2.3.5 release announcement indicate that the issue is resolved by upgrading to version 2.3.5 or later. The current EPSS score of 0.9304 reflects a high probability of exploitation in the wild.