CyberRota Analysis
AI-GeneratedCyberPanel 2.4.3 is vulnerable due to an arbitrary file read issue in its file manager, which allows authenticated attackers to exploit symbolic links in crafted ZIP archives to access sensitive system files outside of their home directories. This vulnerability could lead to unauthorized disclosure of sensitive information, posing a risk to system integrity and confidentiality. Organizations using this version of CyberPanel should prioritize remediation to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
CyberPanel 2.4.3, fixed in commit eca0c3c, contains an arbitrary file read vulnerability in the file manager component that allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. Attackers can exploit the application's failure to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persist on disk and be accessed through the web interface.