VULNERABILITY INTELLIGENCE
CVE-2021-47949
CVSS score8.8 HIGH
EPSS probability0.53%
CISA KEVNot currently listed
Published2026-05-10
Last modified2026-10-06
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.
Weakness classification
- disclosure@vulncheck.com: CWE-59