Vulnerability in Usmannasir Cyberpanel
CVE-2026-71964
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.005 (37.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 38th percentile — 37.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.005 · change: +0.001
Affected products
- Usmannasir Cyberpanel — versions 0, eca0c3cbeb35af8eaae9fafb094e8ef3cd923643
Weakness classification (CWE)
References
- themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/ (technical-description, exploit)
- github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643 (patch)
- www.vulncheck.com/advisories/cyberpanel-arbitrary-file-read-via-file-manager-zi… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-71964?
- CVE-2026-71964 is a medium-severity vulnerability in Usmannasir Cyberpanel, classified under Improper Link Resolution Before File Access. CVSS score: 6.5/10. Published 2026-08-10.
- How severe is CVE-2026-71964?
- Medium severity. CVSS v3 base score is 6.5 out of 10.