CVE-2026-71964

CVE-2026-71964 is a path traversal vulnerability in CyberPanel's file manager that allows authenticated users to escape their home directory containment through symbolic links embedded in ZIP archives. When the file manager extracts a user-uploaded ZIP file, it writes the archive contents to disk without sanitizing symlinks—so an attacker can create a symlink inside their home directory that points to /root, /etc, or another tenant's /home directory, then read files outside their containment zone through the file manager's serving layer. The vulnerability isn't a clever exploit chaining multiple bugs. It's a feature—transparent ZIP symlink handling—added without modeling its interaction with the access control assumptions that users are sandboxed to their home directories. The file manager enforces access control at serving time (when files are downloaded or displayed), but archive extraction persists filesystem objects to disk first. That gap allowed a feature designed for convenience to silently undercut the security boundary. The fix in commit eca0c3c sanitizes symlinks during extraction, which is the correct immediate response. However, this patch addresses one intersection of two subsystems without resolving the underlying design gap: file access control is enforced at serving time, not storage time. Before assuming this is fully resolved, confirm that the fix introduces a general symlink validation layer rather than a surgical patch to just ZIP extraction—adjacent paths (other archive formats, copy/move operations, manual symlink creation) may still permit boundary escapes. Additionally, consider the multi-tenant blast radius. This isn't just 'attacker reads some config files'—in hosting environments, one compromised tenant can read other tenants' data and infrastructure-wide secrets if the web process has access. A CVSS 6.5 obscures this cascade. If you deploy this patch, audit for tenant-to-tenant reads that may have already occurred, and review whether other file operations in the file manager have similar latent bypass vectors.

Reviewed through automated stages and approved by a human before publication.