CVE-2024-51567: CyberPanel upgrademysqlstatus auth bypass and command injection RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network RCE with CVSS 9.8, active in-the-wild exploitation, CISA KEV listing and known ransomware use.

What it is

CyberPanel before commit 5b08cd6 fails to authenticate the upgrademysqlstatus endpoint in databases/views.py, because secMiddleware only guards POST requests. A remote attacker can reach the endpoint with a non-POST request and inject shell metacharacters through the statusfile property to run arbitrary commands.

Impact

An unauthenticated attacker gains remote code execution on the CyberPanel host, which typically runs with high privileges and controls hosted sites and databases. This was used in the wild by PSAUX in October 2024, including ransomware activity.

Attack surface

Reachable over the network via /dataBases/upgrademysqlstatus; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The bypass relies on secMiddleware applying only to POST requests.

Exploitation

Exploited in the wild in October 2024 by PSAUX and added to CISA KEV on 2024-11-07 with known ransomware campaign use; EPSS 30-day probability is 0.866 (99.7th percentile). A public exploit write-up is referenced.

What to do

• Patch CyberPanel to commit 5b08cd6 or later immediately; versions through 2.3.6 and unpatched 2.3.7 are affected.
• If patching is not possible, discontinue use of the product or isolate the CyberPanel management interface from untrusted networks per CISA KEV guidance.
• Restrict access to /dataBases/upgrademysqlstatus and the CyberPanel admin port to trusted management networks only.
• Audit the host for signs of compromise and rotate credentials and keys if exploitation is suspected.

Detection

• Monitor web logs for requests to /dataBases/upgrademysqlstatus, especially non-POST methods or requests containing shell metacharacters in the statusfile parameter.
• Alert on unexpected child processes spawned by the CyberPanel web service (e.g., shell, curl, wget, or download utilities).
• Review host and network telemetry for outbound connections or file writes consistent with PSAUX ransomware staging.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.