Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

usmannasir/cyberpanel

              v3.0.5-dev @ dc005cc
            

232

Fixes

CVEs

CRITICAL

Peak severity

18.4%

Coverage

Highlights

Auth Bypass: 65 prior fixes. Scrutinize any change in this area.

websiteFunctions/website.py: most-fixed (46 issues). Treat as high-risk during review.

193 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Repeatedly missing or bypassable authentication checks (admin.api flag, suspended state, TOTP, password verification) across many API endpoints; fixes show the same pattern recurring.

Command Injection: Many shell commands built from user-controlled parameters (sitename, domain, gitHost, path, statusFile) with incomplete validation; multiple distinct fixes needed for the same sink family.

Command Injection: Middleware character-blacklist validation repeatedly bypassed: list-typed values, filemanager exemption, and control-flow ordering all allowed shell metacharacters through.