Executive brief
CyberPanel, a popular web hosting control panel, contains a security flaw in its AI-powered malware scanner component. An attacker can bypass authentication to inject false information into the system's database or flood the server with junk data. This can lead to service outages, corrupted security reports, and the potential for further attacks against the administrative interface.
Technical details
An authentication bypass exists in CyberPanel's AI Scanner worker API due to a blanket exclusion in the security middleware (`secMiddleware.py`) for paths starting with `/api/`. Specifically, the `/api/ai-scanner/status-webhook` and `/api/ai-scanner/callback` endpoints are decorated with `@csrf_exempt` but lack any session or token-based authentication checks. A remote, unauthenticated attacker can send crafted POST requests to these endpoints to inject arbitrary JSON data into the `ScanHistory` and `ScanStatusUpdate` database tables. While the callback endpoint requires a valid `scan_id`, an attacker can obtain one by triggering a legitimate scan and then pollute the database with malicious findings, potentially leading to storage exhaustion (DoS) or XSS via the administrative UI. The vulnerability is addressed in version 2.4.4 by implementing API key validation.
Affected products
- CyberPanel CyberPanel prior to 2.4.4
Timeline
- 2025-12: disclosed: Vulnerability discovered by researchers during audit.
- 2026-01-18: advisory: Researcher blog post published.
- 2026-04-24: advisory: CVE published to NVD.
- 2026-04-24: patched: Fix included in version 2.4.4.