CVE-2026-71964: CyberPanel 2.4.3 Arbitrary File Read via File Manager ZIP Upload
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CyberPanel (file manager)to a version that resolves this vulnerability.Fixed in 2.4.3Patch eca0c3c - Compensating control
Mitigate before upgrading by blocking or restricting access to CyberPanel File Manager ZIP upload functionality for authenticated users until the fixed commit eca0c3c is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71964?
The severity of CVE-2026-71964 is classified as medium with a score of 6.5.
How do I fix CVE-2026-71964?
To fix CVE-2026-71964, you should upgrade to CyberPanel version 2.4.3 or later where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-71964?
CVE-2026-71964 is an arbitrary file read vulnerability that can be exploited via the file manager component of CyberPanel.
Who can exploit CVE-2026-71964?
CVE-2026-71964 can be exploited by authenticated attackers who can upload crafted ZIP archives.
What files can be accessed due to CVE-2026-71964?
CVE-2026-71964 allows attackers to read sensitive system files by exploiting the application's failure to handle symbolic links in uploaded ZIP archives.