CVE-2026-71964
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.
| CWE | CWE-59 |
| Vendor | usmannasir |
| Product | cyberpanel |
| Published | Aug 10, 2026 |
| Last Updated | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for usmannasir cyberpanel
Be the first to know when new medium vulnerabilities affecting usmannasir cyberpanel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
usmannasir / cyberpanel
0 ≤ 2.4.3
References
Credits
McSam