CVE-2021-47949
CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack
- State
- Published
- Severity
- 8.7 High
- Published
- May 10, 2026
- Updated
- May 11, 2026
- Reserved
- Feb 1, 2026
Description
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected Products
| Product | Versions |
|---|---|
CyberPanelCyberpanel |
|
References
- ExploitDB-50230exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attackthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.