Executive brief
Ajenti is a web-based server administration panel for Linux and BSD systems. An authenticated user with low privileges can bypass authorization controls to install, remove, or upgrade plugins by manipulating package names and versions, leading to root code execution and complete server compromise.
Technical details
The /api/core/tasks/start endpoint in Ajenti prior to 2.2.16 lacks authorization checks for InstallPlugin, UnInstallPlugin, and UpgradeAll tasks. These tasks construct pip package specifications from unvalidated name and version fields and execute pip as root, allowing authenticated users without plugin-management permissions to perform privilege escalation. Attackers can inject malicious package specifications to achieve arbitrary code execution with root privileges.
Affected products
- Ajenti Ajenti before 2.2.16
Timeline
- 2026-09-21: disclosed