Get real-time updates on Telegram
CVE-2026-67613: cyberpanel 0 to before 3.0.0
CVE-2026-67613. CVSS 3.1 base score 4.9 (MEDIUM, Vendor/CNA). EPSS 0.00498 (percentile 0.41773), scored 22-Oct-2026.
Affected technology
cyberpanel · 0 to before 3.0.0
usmannasir
Description’s affected range: before 3.0.0
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · High privileges required · No user interaction required
What an attacker can do
Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files. Vendor/CNA’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality impact as high; integrity and availability impact as none.
- CWE
- CWE-22
- CCR priority
- 19.7 /100 (P5)
- CVSS 3.1
- 4.9 /10 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N · Vendor/CNA
- EPSS
- 0.00498 · percentile 0.41773 · 2026-10-22
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-24 01:40:49.068977+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-67613.html