CVE-2026-71966: Improper Neutralization of Special Elements used in an OS Command

CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated command injection vulnerability in the remote backup transfer feature that allows authenticated attackers to execute arbitrary OS commands by controlling a remote server's API response. Attackers can inject malicious commands...

PT-2026-69917

Name of the Vulnerable Software and Affected Versions CyberPanel version 2.4.3 Description An authenticated command injection issue exists in the remote backup transfer feature. Authenticated attackers can execute arbitrary OS commands by controlling the API response of a remote server. By...