CVE-2024-51568

Critical · 9.8

CVSS

9.8

EPSS

47.7%

Published

Oct 29, 2024

CISA due date

—

The record

CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. There is /filemanager/upload (aka File Manager upload) unauthenticated remote code execution via shell metacharacters.

Affected packages

Ecosystem	Package	Introduced	Fixed