CVE-2026-71966

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-71966

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71966.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-71966

Published

2026-08-10T18:53:12Z

Modified

2026-10-28T02:30:59Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

CyberPanel 2.4.3 Authenticated Command Injection via starRemoteTransfer

Details

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands through a crafted directory name in the remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-78"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71966.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "2.4.3"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        },
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "last_affected":  "2.4.3"
                        }
                    ],
                    "source":  "CPE_FIELD",
                    "strategy":  "CPEApplicability"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/usmannasir/cyberpanel

Affected ranges

Type

GIT

Repo

https://github.com/usmannasir/cyberpanel

Events

Introduced

Fixed

eca0c3c

Fixed

eca0c3cbeb35af8eaae9fafb094e8ef3cd923643

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "eca0c3c"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "eca0c3c"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "range":  [
                {
                    "fixed":  "eca0c3cbeb35af8eaae9fafb094e8ef3cd923643"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71966.json"