{"id":"CVE-2021-47949","state":"PUBLISHED","title":"CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack","description":"CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.","publishedAt":"2026-05-10T12:52:10.631Z","updatedAt":"2026-05-11T12:51:17.987Z","severity":{"score":8.7,"label":"High","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"VulnCheck"},"assigner":"VulnCheck","products":["Cyberpanel CyberPanel"],"affected":[{"vendor":"Cyberpanel","product":"CyberPanel","versions":[{"version":"<= 2.1","status":"affected"}]}],"references":["https://www.exploit-db.com/exploits/50230","https://cyberpanel.net/","https://github.com/usmannasir/cyberpanel","https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack"],"weaknesses":["CWE-59"],"ingestedAt":"2026-10-29T19:49:19.404Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2021/47xxx/CVE-2021-47949.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2021-47949","state":"PUBLISHED","datePublished":"2026-05-10T12:52:10.631Z","dateUpdated":"2026-05-11T12:51:17.987Z","assignerShortName":"VulnCheck","assignerOrgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateReserved":"2026-02-01T11:24:18.719Z"},"containers":{"cna":{"title":"CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack","descriptions":[{"lang":"en","value":"CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint."}],"affected":[{"vendor":"Cyberpanel","product":"CyberPanel","versions":[{"version":"<= 2.1","status":"affected"}]}],"references":[{"url":"https://www.exploit-db.com/exploits/50230","name":"ExploitDB-50230","tags":["exploit"]},{"url":"https://cyberpanel.net/","name":"Official Product Homepage","tags":["product"]},{"url":"https://github.com/usmannasir/cyberpanel","name":"Product Reference","tags":["product"]},{"url":"https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack","name":"VulnCheck Advisory: CyberPanel 2.1 Authenticated Remote Code Execution via Symlink Attack","tags":["third-party-advisory"]}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","baseScore":8.7,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS"},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-59","lang":"en","description":"Improper Link Resolution Before File Access ('Link Following')","type":"CWE"}]}],"providerMetadata":{"shortName":"VulnCheck","orgId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","dateUpdated":"2026-05-10T12:52:10.631Z"},"datePublic":"2021-08-27T00:00:00.000Z","cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*","versionEndIncluding":"2.1"}]}]}],"credits":[{"lang":"en","value":"Numan Türle","type":"finder"}],"x_generator":{"engine":"vulncheck"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-11T12:50:59.565034Z","id":"CVE-2021-47949","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-11T12:51:17.987Z"}}]}}}