CVE-2024-51568: CyberPanel unauthenticated command injection in File Manager upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable command injection with a 9.8 CVSS score and high EPSS probability makes this an urgent patch target.

What it is

CyberPanel before 2.3.5 passes the completePath value into ProcessUtilities.outputExecutioner() without sanitising shell metacharacters, allowing OS command injection. The /filemanager/upload endpoint is reachable without authentication, so the flaw exposes a pre-auth remote code execution path on the panel host.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the server running CyberPanel, leading to full host compromise, data theft and use of the box as a pivot or bot.

Attack surface

Reached over the network through the /filemanager/upload endpoint; the CVSS vector (AV:N/PR:N/UI:N) and the description both indicate no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware association is recorded, but EPSS is 0.45737 (98.7th percentile) and a public third-party exploit write-up is referenced, so exploitation is plausible and likely.

What to do

• Upgrade CyberPanel to 2.3.5 or later immediately.
• If patching cannot be done at once, block or restrict access to /filemanager/upload at the reverse proxy or firewall.
• Do not expose the CyberPanel admin interface to the public internet; place it behind a VPN or IP allowlist.
• Review the host for webshells, unexpected files and unauthorised cron or systemd entries after exposure.
• Rotate credentials and secrets stored on the panel host in case of prior compromise.

Detection

• Monitor web logs for POST requests to /filemanager/upload containing shell metacharacters such as ;, |, $() or backticks.
• Alert on child processes spawned by the CyberPanel web service (for example sh, bash, curl, wget) outside normal panel operations.
• Hunt for new or modified files in web-accessible directories and for outbound connections from the panel host to unknown addresses.
• Correlate CyberPanel access logs with system audit logs to spot command execution tied to upload requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.