CVE-2026-67613

Name of the Vulnerable Software and Affected Versions CyberPanel versions prior to 3.0.0

Description Authenticated administrators can read arbitrary files from the server filesystem by supplying unsanitized file paths to the 'cloudAPI ReadReport' endpoint. This occurs because the reportFile parameter in the JSON request body is passed directly to the open() function in cloudManager.py without validation or allowlisting. This allows access to any file readable by the root-privileged CyberPanel process, such as credential files, SSL and SSH private keys, and JWT secret files.

Recommendations Update CyberPanel to version 3.0.0 or later. Avoid using the reportFile parameter in the 'cloudAPI ReadReport' endpoint until the update is applied.