Critical CyberPanel RCE Chain (CVE-2024-7067) Lets Attackers Gain Server Shell

Key Takeaways

• A critical pre-authentication Remote Code Execution (RCE) chain has been identified in CyberPanel.
• This vulnerability allows attackers to gain a shell on vulnerable hosting servers without needing any credentials.
• The RCE chain, tracked as CVE-2024-7067, affects CyberPanel versions older than 2.4.4.
• A patch is available, and administrators are urged to update immediately.

Cybersecurity researchers have uncovered a severe pre-authentication RCE chain within CyberPanel, a popular web hosting control panel. This critical flaw, designated CVE-2024-7067, could allow malicious actors to achieve full shell access on susceptible hosting servers, bypassing the need for any form of authentication.

The intricate attack vector combines multiple vulnerabilities: a flaw in the platform’s AI Scanner functionality, a stored cross-site scripting (XSS) vulnerability, and the abuse of cron job capabilities. The vulnerability impacts all CyberPanel versions preceding 2.4.4.

As a centralized control plane for managing websites, DNS, email, databases, and various server services, a successful compromise of CyberPanel can grant attackers extensive control over hosted environments and their associated data.

Unpacking the CyberPanel RCE Chain

The RCE chain was discovered by Pentera researchers during a comprehensive analysis of internet-facing hosting panels. Their investigation revealed that CyberPanel included an unauthenticated AI Scanner endpoint designed to receive scan data from an external service. This endpoint, however, lacked proper input sanitization.

Initial Vulnerabilities: XSS and Access Control Bypass

The AI Scanner endpoint accepted user-supplied scan results and stored them directly in the application database without adequate content sanitization. This oversight led to a stored cross-site scripting vulnerability, identified as CVE-2026-41472. An attacker could embed malicious JavaScript within a crafted scan result. Initially, a crucial hurdle existed: the request demanded a valid scan_id, without which the application would reject the submission.

The missing piece to bypass this limitation was an exposed debug API endpoint: /api/ai-scanner/list-api-keys. This endpoint could be accessed without any authentication and was found to return information about recent AI scans, including valid scan_id values. This critical access-control flaw, tracked as CVE-2026-41473, enabled attackers to procure the necessary identifier to submit a malicious scan result.

Privilege Escalation via Stored XSS

Once a valid scan_id was obtained, an attacker could inject JavaScript into a stored scan record. This malicious code would not execute immediately but would lie dormant until a CyberPanel administrator navigated to the AI Scanner results page. Upon an administrator viewing the poisoned result, the embedded script would execute within their authenticated browser session.

The malicious code could then leverage the administrator’s active session and Cross-Site Request Forgery (CSRF) token to perform actions on their behalf. As Pentera researchers demonstrated, the script could silently create a new administrative account. This maneuver provided the attacker with legitimate access to the CyberPanel dashboard without needing to directly compromise or steal the administrator’s password.

Final Stage: Cron Job Abuse for Server Shell

The final stage of the attack involved exploiting CyberPanel’s cron job management feature. After logging in with the newly created administrative account, an attacker could create a website and an associated system user. Subsequently, they could abuse the cron job functionality to execute arbitrary commands on the server.

Researchers discovered that the cronCommand parameter dangerously allowed for direct shell command execution, ultimately enabling the attacker to obtain a server shell. This complete chain illustrates how several seemingly minor vulnerabilities, when combined, can lead to a full server takeover, from data leakage through an exposed API to privilege abuse via stored XSS and ultimately command execution through cron job manipulation.

Mitigation and Patching

Pentera responsibly disclosed these vulnerabilities to CyberPanel on May 4, 2026. The CyberPanel team responded swiftly, reportedly deploying fixes within approximately four hours. These patches included the removal of debug endpoints, the implementation of authentication for callback functionality, and robust output escaping to prevent XSS.

What You Should Do

• Update Immediately: All CyberPanel administrators must update their installations to version 2.4.4 or later without delay.
• Apply Workarounds: If immediate patching is not feasible, organizations should disable the AI Scanner feature.
• Restrict Access: Furthermore, access to the /api/ai-scanner/list-api-keys and /api/ai-scanner/test-auth endpoints should be severely restricted until updates can be fully deployed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.