CVE-2021-47949

· HIGHAwaiting Analysis

← All CVEs

CVSS v3.1

8.8

CVSS v4.0

8.7

EPSS

0.53%

Published

May 10, 2026

Modified

Jul 25, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-59

References (4)

https://cyberpanel.net/

https://github.com/usmannasir/cyberpanel

https://www.exploit-db.com/exploits/50230

https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack

KEV Catalog EPSS Scores Vendors All CVEs