CVE-2024-51568

CVE-2024-51568 is an unauthenticated operating-system command injection (CWE-78) in CyberPanel before 2.3.5, in the File Manager upload endpoint (/filemanager/upload). The flaw occurs when user-supplied input (completePath) is passed unsanitized into the ProcessUtilities.outputExecutioner() command-execution sink, so an attacker who submits a crafted upload request containing shell metacharacters can have arbitrary commands executed with no authentication and no user interaction. Successful exploitation yields full remote code execution on the affected server, giving the attacker control of the hosting node and everything it serves or manages. All CyberPanel installations older than 2.3.5 are affected, with the greatest risk on internet-exposed servers. A public proof-of-concept is available and the flaw carries a high exploitation probability (EPSS 45.5%, 99th percentile), though it is not yet listed in CISA KEV.

What to do: Upgrade CyberPanel to version 2.3.5 or later immediately, as this fixes the command injection. Until patched, restrict network access to the CyberPanel management interface and the /filemanager/upload endpoint to trusted source IPs (firewall/allowlist), and check for signs of compromise such as unexpected processes, cron jobs, or uploaded webshells given the high exploitation probability.