---
id: CVE-2021-47949
title: >-
  CyberPanel 2.1 contains a command execution vulnerability that allows
  authenticated attackers to read arbitrary files and execute remote code by
  exploiting symlink attacks through the filemanager controller endpoint
summary: >-
  CyberPanel 2.1 contains a command execution vulnerability that allows
  authenticated attackers to read arbitrary files and execute remote code by
  exploiting symlink attacks through the filemanager controller endpoint.
  Attackers can manipu…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-59
published: '2026-05-10'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T22:10:00.247'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2021-47949'
references:
  - url: 'https://cyberpanel.net/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/usmannasir/cyberpanel'
    label: disclosure@vulncheck.com
  - url: 'https://www.exploit-db.com/exploits/50230'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cyberpanel-authenticated-remote-code-execution-via-symlink-attack
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00533
epssPercentile: 0.43131
ingestedAt: '2026-10-06T22:23:15.922Z'
---

## Overview

CyberPanel 2.1 contains a command execution vulnerability that allows authenticated attackers to read arbitrary files and execute remote code by exploiting symlink attacks through the filemanager controller endpoint. Attackers can manipulate the completeStartingPath parameter in POST requests to /filemanager/controller to create symbolic links, read sensitive files like database credentials, and execute arbitrary shell commands through the /websites/fetchFolderDetails endpoint.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.