CyberPanel <=2.4.9 File Read & Web Terminal RCE Vulnerabilities (CVE-2026-67613/67614) Patch Details

Vulnerability Overview Vulnerability ID: GHSA-q33g-3m5v-r9v9 Reporter: Deniz Mert (@dennywise) Report Date: 2 weeks ago Status: Closed, marked as resolved Impact Scope Affected Versions: CyberPanel <= 2.4.9 Vulnerability Types: Two critical security vulnerabilities Remediation 1. Initial Remediation: - Version: CyberPanel 3.0.0 - Actions: Partially addressed the reported chain of issues, with ongoing fixes and verification conducted under private disclosure. 2. Full Remediation: - Version: CyberPanel 3.0.1 - Actions: - Retrieval now uses short-lived, one-time private handles instead of caller-provided file system paths. - Web terminal keys are generated during installation and refreshed via the installation/upgrade process. - The private advisory now records as the patched version and includes full verification results. - Verified the public updater and related regression/sanity checks on Ubuntu 26.04. 3. Further Hardening: - Version: CyberPanel 3.0.1 - Actions: - Removed hardcoded JWT keys. - Web terminal authorization no longer depends on installation-time generated keys. - Each signed token must be bound to a private, short-lived, one-time server authorization, which is atomically consumed between authenticating the panel user and the website system account. - The terminal service also rejects UID 0 and accounts whose home directories are outside . 4. Final Verification: - Version: CyberPanel 3.0.1 - Actions: - Conducted live verification on Ubuntu 26, completing legitimate out-of-band user terminal sessions, rejecting reuse of the same token, and rejecting tokens with valid signatures but without a valid one-time server authorization at installation time. - The private advisory has been updated based on these results. Additional Information CVE Assignments: - CVE-2026-67613: File read vulnerability - CVE-2026-67614: Web terminal vulnerability Coordinated Disclosure: - Supports coordinated public disclosure once the private advisory and reserved CVE details are finalized. - CVE release is recommended before the end of August. Summary Two critical security vulnerabilities exist in CyberPanel version 2.4.9 and earlier. These issues are comprehensively addressed in CyberPanel 3.0.1, including the removal of hardcoded keys, the use of one-time authorization tokens, and enhanced security for the terminal service. CVE-2026-67613 and CVE-2026-67614 have been assigned to these vulnerabilities, with public disclosure planned before the end of August.

Goal Reached Thanks to every supporter — we hit 100%!

CyberPanel <=2.4.9 File Read & Web Terminal RCE Vulnerabilities (CVE-2026-67613/67614) Patch Details

More from this source