CVE-2026-71964

Beschreibung

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application-s failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user-s home directory to persist on disk and be accessed through the web interface.