CVE-2024-51568: CyberPanel

Critical severity, CVSS 9.8. EPSS: 45.7% chance of exploitation in the next 30 days.

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.

Affected products

• CyberPanel CyberPanel: before 2.3.5 (fixed in 2.3.5)

Published 2024-10-29. Last modified 2026-06-17.