CVE-2026-71966: CyberPanel Command Injection Vulnerability

CVE-2026-71966 Overview

CVE-2026-71966 is an authenticated command injection vulnerability in CyberPanel 2.4.3, tracked under CWE-78. The flaw affects the remote backup transfer feature, where a crafted directory name in a remote server's API response is passed unsanitized to an OS command execution function. Authenticated attackers who control the remote server referenced by the transfer request can inject arbitrary operating system commands. The security middleware validation is bypassed because the malicious payload arrives from an external API response rather than direct user input. The issue is fixed in commit eca0c3c.

Critical Impact
Authenticated attackers can execute arbitrary OS commands on the CyberPanel host by controlling the API response of a remote backup server, leading to full server compromise.

Affected Products

CyberPanel 2.4.3
CyberPanel builds prior to commit eca0c3c
Deployments using the StartRemoteTransfer remote backup feature

Discovery Timeline

2026-08-10 - CVE-2026-71966 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-71966

Vulnerability Analysis

The vulnerability resides in the CyberPanel remote backup transfer workflow implemented in plogical/remoteBackup.py. When the CyberPanel host initiates a transfer against a remote server, it consumes JSON data returned by that remote server's API endpoint. Fields describing remote directory names are then interpolated into shell commands executed on the local host.

Because the remote API response is treated as trusted data, standard request-time middleware never inspects the injected payload. An authenticated user with permission to configure a remote transfer can point CyberPanel at an attacker-controlled server that returns a directory name containing shell metacharacters. This turns a benign backup workflow into arbitrary command execution.

Root Cause

The root cause is missing input sanitization at the boundary between external API data and OS command construction (CWE-78). Data received over the network from a remote peer is concatenated into shell command strings without validation, escaping, or use of argument arrays. The patch introduces the re module in remoteBackup.py, indicating that fixed code applies regular-expression-based validation to directory names before they reach the command executor.

Attack Vector

Exploitation requires an authenticated CyberPanel account with access to the remote backup transfer feature. The attacker stands up a rogue backup peer that mimics the CyberPanel remote transfer API. When the victim initiates or is coerced into initiating a transfer against the rogue peer, the peer replies with a directory listing containing an injected shell payload. CyberPanel then executes the payload on its own host.

python

# Patch excerpt: plogical/remoteBackup.py
from plogical import CyberCPLogFileWriter as logging
import os
+import re
import requests
import json
import time

Source: GitHub commit eca0c3c

The patch also imports os into filemanager/views.py, part of a broader hardening pass around file operations:

python

# Patch excerpt: filemanager/views.py
 # -*- coding: utf-8 -*-
+import os
from django.shortcuts import render,redirect
from loginSystem.models import Administrator
from loginSystem.views import loadLoginPage

Source: GitHub commit eca0c3c

Detection Methods for CVE-2026-71966

Indicators of Compromise

Outbound HTTP or HTTPS connections from the CyberPanel host to unfamiliar remote backup endpoints followed by shell child processes.
Unexpected child processes such as sh, bash, curl, or wget spawned by CyberPanel's Python worker processes.
Directory names in backup logs containing shell metacharacters such as ;, |, &, backticks, or $(...).
New cron jobs, SSH keys, or web shells created after a remote transfer operation.

Detection Strategies

Alert on CyberPanel Python processes (gunicorn, lscpd, or python) spawning shell interpreters that then execute network utilities.
Inspect application logs for StartRemoteTransfer invocations correlated with outbound traffic to non-approved hosts.
Baseline the set of remote backup destinations and flag any newly configured peer.

Monitoring Recommendations

Enable process-tree telemetry on CyberPanel hosts and forward it to a centralized analytics platform for retroactive hunting.
Log full command lines for any process spawned as a descendant of the CyberPanel service account.
Monitor /home and web-root directories for file writes made by the CyberPanel process outside of normal deployment windows.

How to Mitigate CVE-2026-71966

Immediate Actions Required

Upgrade CyberPanel to a build containing commit eca0c3c or later from the official repository.
Audit all CyberPanel administrator and reseller accounts and revoke unused credentials.
Restrict the list of remote backup peers to a hard-coded allowlist of trusted IPs or hostnames.
Review recent StartRemoteTransfer activity for connections to unknown remote servers.

Patch Information

The fix is delivered in CyberPanel commit eca0c3c, which adds the re module to plogical/remoteBackup.py to validate remote directory names and adds hardening imports to filemanager/views.py. See the VulnCheck advisory and the MCSAM CyberPanel 2.4.3 write-up for additional context.

Workarounds

Disable the remote backup transfer feature until the patched build can be deployed.
Place the CyberPanel management interface behind a VPN or IP allowlist to reduce credential exposure.
Enforce network egress filtering so the CyberPanel host can only reach approved backup destinations.
Rotate any credentials or API tokens stored on CyberPanel hosts that may have processed untrusted remote transfers.

bash

# Restrict outbound traffic from CyberPanel to a single trusted backup peer
iptables -A OUTPUT -p tcp -d backup.trusted.example --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 443 -j REJECT