Loading story…
CyberPanel 2.3.6 contained an unauthenticated, zero-click remote code-execution flaw in the /dataBases/upgrademysqlstatus endpoint. A user-controlled statusfile parameter was concatenated into sudo cat and sudo rm -f commands, allowing an unauthenticated attacker to execute commands with root privileges.
CyberPanel's secMiddleware attempted to block malicious POST input, but the endpoint processed request bodies regardless of HTTP method; attackers could use methods such as PUT to bypass the filter. Maintainers were notified and published a patch commit, and the issues were assigned CVE-2024-51567 and CVE-2024-51568. The disclosure also noted a separate prior 2.3.5 File Manager upload weakness in which exception handling could bypass authentication and reach a command-execution sink.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2024-51567 and CVE-2024-51568 were assigned to the disclosed CyberPanel security issues.
CyberPanel maintainers were notified of the vulnerabilities and published patch commit 5b08cd6d53f4dbc2107ad9f555122ce8b0996515.
A zero-click, unauthenticated command-injection vulnerability was reported in CyberPanel v2.3.6's /dataBases/upgrademysqlstatus endpoint. Attackers could use a non-POST request such as PUT to bypass POST-only filtering and inject commands through statusfile, reportedly executing them with root privileges.
CyberPanel version 2.3.5 addressed a prior File Manager upload issue in which exception handling could allow unauthenticated requests to reach the upload operation and inject commands through the completePath parameter.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical blind SQL injection flaw tracked as **`CVE-2026-57517`** affects **Control Web Panel** versions **`<= 0.9.8.1224`** through the **`userRes`** POST parameter on the user endpoint. Public disclosure says the bug can be exploited remotely without authentication, although an attacker may need to know or guess a valid non-root username on the target instance. The issue carries a **CVSS v3.1 score of 9.8** and allows arbitrary SQL execution against the backend database with **MySQL root** privileges. The disclosed attack path shows the database access can be escalated into arbitrary file write using MySQL features such as **`INTO DUMPFILE`**, allowing a PHP webshell to be written into a web-accessible **Roundcube logs** directory and resulting in remote code execution as the **`cwpsvc`** account. The vulnerability was disclosed by **Egidio Romano**, and the vendor has fixed it in **Control Web Panel `0.9.8.1225`**; administrators are being urged to upgrade immediately and apply the vendor's security updates.
Jul 2, 2026
cPanel disclosed and patched **CVE-2026-58048**, a critical privilege-escalation flaw in **cPanel & WHM** that allows an authenticated user with **MySQL** or **MariaDB** access to execute arbitrary SQL commands with full database administrator privileges. The bug, rated **CVSS 9.4**, affects all supported cPanel & WHM versions and **WP Squared**, and stems from the database rename process failing to preserve SQL mode correctly, enabling escalation into the database root context. The company warned that in some shared-hosting, database, and operating-system configurations, the flaw could extend beyond database control to **OS-level compromise** and potentially full server takeover. cPanel said customers should upgrade immediately to fixed releases; if patching is delayed, administrators should temporarily revoke the MySQL feature from cPanel users and review database audit logs for suspicious administrative activity. **CISA** said no active exploitation had been observed and classified the issue as non-automatable despite its severe technical impact.
Aug 5, 2026
cPanel disclosed and patched a critical authentication bypass in cPanel & WHM, tracked as **`CVE-2026-41940`**, after reports of active in-the-wild exploitation against hosting infrastructure. The flaw affects authentication paths in supported versions and can let unauthenticated attackers reach administrative interfaces, forge authenticated sessions, and potentially gain control of hosted websites, databases, email accounts, and server configuration. Government and industry alerts warned that shared hosting environments face outsized risk because a single compromised server can expose many downstream customer sites, and some providers temporarily restricted cPanel and WHM login ports while applying fixes. Public technical analysis and a GitHub proof-of-concept described an exploit chain involving manipulated HTTP headers and session cookie handling to create forged privileged sessions, including possible root-level WHM access. Separately, cPanel also patched three additional vulnerabilities in cPanel & WHM and **WP Squared**—**`CVE-2026-29201`**, **`CVE-2026-29202`**, and **`CVE-2026-29203`**—that enable arbitrary file read through path traversal, Perl code injection leading to remote code execution, and denial-of-service via unsafe symlink handling. The most severe of the newly disclosed flaws, **`CVE-2026-29202`**, affects the `create_user` API and can allow arbitrary Perl code execution on the server, reinforcing calls for immediate upgrades, restricted access to management interfaces, and log review for suspicious authorization and cookie activity.
Jun 29, 2026