What’s Vulnerable › Vulnerabilities

CVE-2024-51568

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 47.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-10-29 · updated 2026-06-17
• Weakness: CWE-78

Description

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.

Affected products

• usmannasir cyberpanel: before 2.3.5 — fixed in 2.3.5

How to fix

Upgrade to a fixed version: usmannasir cyberpanel 2.3.5. Check the vendor advisory for mitigations.

References

• https://cwe.mitre.org/data/definitions/78.html
• https://cyberpanel.net/KnowledgeBase/home/change-logs/
• https://cyberpanel.net/blog/cyberpanel-v2-3-5
• https://dreyand.rs/code/review/2024/10/27/what-are-my-options-cyberpanel-v236-pre-auth-rce

Get alerted when CVE-2024-51568 or the next vulnerability affects your stack