What’s Vulnerable › Vulnerabilities

CVE-2021-47949: CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-10 · updated 2026-10-06
• Weakness: CWE-59

Description

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

Affected products

• usmannasir cyberpanel: through 2.1

References

• https://cyberpanel.net/
• https://github.com/usmannasir/cyberpanel
• https://www.exploit-db.com/exploits/50230
• https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack

Get alerted when CVE-2021-47949 or the next vulnerability affects your stack