Executive brief
CyberPanel, a popular web hosting control panel, contains a security flaw in its AI-powered malware scanner dashboard. An unauthenticated attacker can inject malicious code into the system's scan history records. If an administrator views the scanner dashboard, this code executes in their browser, allowing the attacker to perform actions as the administrator, such as scheduling malicious tasks that lead to a full takeover of the server.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in CyberPanel's AI Scanner component due to a lack of authentication in the 'POST /api/ai-scanner/callback' endpoint. The underlying issue stems from a middleware configuration that bypasses authentication for all '/api/*' paths, relying on individual views to implement security checks. The 'scan_callback' function fails to validate the requester's identity and directly stores attacker-controlled JSON data into the 'findings_json' field of 'ScanHistory' records. When an authenticated administrator visits the AI Scanner dashboard, the unsanitized data is rendered, executing the attacker's JavaScript. This can be leveraged to perform same-origin requests to plant malicious cron jobs, resulting in remote code execution (RCE). The vulnerability is fixed in version 2.4.4.
Affected products
- usmannasir CyberPanel < 2.4.4
Timeline
- 2025-12: disclosed: Vulnerability discovered by researchers during audit.
- 2026-01-18: advisory: Researcher blog post published.
- 2026-04-24: advisory: NVD/VulnCheck advisory published.
- 2026-04-24: patched: Fix included in version 2.4.4.