Medium severity · published Aug 10, 2026
CVE-2026-71964
CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
6.5
CVSS
0.5%
EPSS
No
On KEV
Description
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CY
cyberpanel · usmannasir
through 2.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-71964
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-71964
github.com
https://github.com/usmannasir/cyberpanel/commit/eca0c3cbeb35af8eaae9fafb094e8ef3cd923643
themcsam.github.io
https://themcsam.github.io/posts/cyberpanel-2.4.3-vulnerabilties/
www.vulncheck.com
https://www.vulncheck.com/advisories/cyberpanel-arbitrary-file-read-via-file-manager-zip-upload
More from cyberpanel
9.8
CVE-2026-67614
CyberPanel < 3.0.0 Hard-coded JWT Secret Authentication Bypass via WebTerminal
9.1
CVE-2026-41473
CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints
8.8
CVE-2026-71966
CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer
8.8
CVE-2026-71965
CyberPanel 2.4.3 Authenticated RCE via Remote Backup Feature
8.8
CVE-2026-65917
CyberPanel IncBackups IDOR via Sequential Backup ID