CVE-2026-71964: CyberPanel Path Traversal Vulnerability

CVE-2026-71964 Overview

CVE-2026-71964 is an arbitrary file read vulnerability in CyberPanel 2.4.3, tracked under [CWE-59] (Improper Link Resolution Before File Access, also known as a symlink attack). The flaw resides in the file manager component and allows authenticated attackers to read sensitive files anywhere on the host filesystem. Exploitation requires uploading a crafted ZIP archive containing symbolic links that reference paths outside the user's home directory. CyberPanel's extraction routine fails to validate or sanitize symlinks before writing them to disk, causing the links to persist and become accessible through the web interface. The issue is fixed in commit eca0c3c.

Critical Impact
Authenticated attackers can read arbitrary files on the underlying host, including configuration files, credentials, and private keys, by uploading a ZIP archive that embeds symbolic links pointing outside the user's home directory.

Affected Products

CyberPanel 2.4.3
CyberPanel builds prior to commit eca0c3c
Deployments exposing the file manager component to authenticated users

Discovery Timeline

2026-08-10 - CVE-2026-71964 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-71964

Vulnerability Analysis

The vulnerability originates in CyberPanel's ZIP extraction handler within the file manager. When an authenticated user uploads a ZIP archive, the application extracts its contents into the user's home directory without inspecting entry types. ZIP archives can encode symbolic links as file entries with specific attribute flags. The extractor honors those flags and writes the symlinks to disk verbatim.

Once written, a symlink pointing to /etc/passwd, /etc/shadow, or an application configuration file resolves to the target during subsequent file manager read operations. The web interface then returns the linked file's contents to the attacker. Because CyberPanel commonly runs with elevated privileges to manage hosting resources, the attacker can access files that the low-privileged authenticated user would not otherwise be able to read.

Root Cause

The root cause is missing symlink validation during archive extraction. CyberPanel treats every archive entry as a regular file operation and does not verify whether extracted paths resolve within the user's permitted directory. This is a classic [CWE-59] link-following weakness.

Attack Vector

Attack execution requires network access to the CyberPanel web interface and valid credentials for any user with file manager access. The attacker crafts a ZIP archive locally containing one or more symlink entries whose targets reference sensitive filesystem paths. After upload and extraction, the attacker requests the extracted symlink through the file manager's read or download endpoints. The server dereferences the symlink and returns the target file's contents.

python

# Security patch in filemanager/views.py (excerpt)
# -*- coding: utf-8 -*-
import os
from django.shortcuts import render, redirect
from loginSystem.models import Administrator
from loginSystem.views import loadLoginPage

Source: GitHub commit eca0c3c. The patch introduces additional imports and validation logic in filemanager/views.py and plogical/remoteBackup.py to reject symlink entries and constrain extracted paths.

Detection Methods for CVE-2026-71964

Indicators of Compromise

Symbolic link files present inside CyberPanel user home directories whose targets reference paths outside the home directory, such as /etc/, /root/, or /var/.
ZIP archive uploads to the file manager followed by read requests for files with unusual extensions or no extension.
Web server access logs showing sequential POST uploads and GET download requests against the file manager for the same filename.

Detection Strategies

Scan CyberPanel user directories for symlinks using find /home -type l -lname '/*' and flag any link whose target escapes the parent home directory.
Inspect uploaded ZIP archives with unzip -l or zipinfo to identify entries with symlink attributes before extraction.
Correlate file manager upload events with immediate download events for the same path in application and web server logs.

Monitoring Recommendations

Enable process auditing for the CyberPanel service account and alert on reads to sensitive files such as /etc/shadow, /etc/cyberpanel/, and SSH private keys.
Monitor Django application logs for repeated file manager extraction operations from a single authenticated session.
Alert on symlink creation events under user home directories via Linux audit rules watching the symlink and symlinkat syscalls.

How to Mitigate CVE-2026-71964

Immediate Actions Required

Upgrade CyberPanel to a build that includes commit eca0c3c or later, which adds symlink validation during archive extraction.
Audit existing user home directories for symlinks referencing paths outside the home directory and remove any unauthorized links.
Rotate credentials, API tokens, and private keys that may have been readable through the file manager on affected systems.

Patch Information

The fix is committed to the CyberPanel repository as commit eca0c3c. Changes span filemanager/views.py and plogical/remoteBackup.py, adding path normalization and rejection of symlink entries during ZIP extraction. Administrators running CyberPanel 2.4.3 should pull the latest release and restart the CyberPanel service. Refer to the VulnCheck advisory and the MCSAM technical write-up for additional context.

Workarounds

Disable the file manager component or restrict access to trusted administrators until the patch is applied.
Run CyberPanel behind a reverse proxy that inspects uploaded archives and blocks ZIP files containing symlink entries.
Enforce filesystem-level access controls so the CyberPanel service account cannot read sensitive files outside its operational scope.

bash

# Audit for suspicious symlinks in CyberPanel user home directories
find /home -type l -exec ls -la {} \; | \
  awk '$NF !~ /^\/home\// {print}'

# Inspect a ZIP archive for symlink entries before allowing extraction
unzip -l suspicious.zip | grep -E '^\s*[0-9]+\s+.*->'