High severity · published May 10, 2026
CVE-2021-47949
CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CY
CyberPanel · Cyberpanel
<= 2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-47949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-47949
cyberpanel.net
https://cyberpanel.net/
github.com
https://github.com/usmannasir/cyberpanel
www.exploit-db.com
https://www.exploit-db.com/exploits/50230
www.vulncheck.com
https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack
More from CyberPanel
9.8
CVE-2024-51378
CyberPanel Incorrect Default Permissions Vulnerability
9.8
CVE-2024-51567
CyberPanel Incorrect Default Permissions Vulnerability
9.8
CVE-2024-51568
CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink
9.1
CVE-2026-41473
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
8.8
CVE-2024-53376
CyberPanel before 2.3.8 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the phpSelection field to the websites/submitWebsiteCreation…