{"id":"CVE-2026-16283","kind":"vulnerability","aliases":["CVE-2026-16283"],"related":[],"title":"Osbil oPanel: OS command injection before 1.20.66 lets attackers run commands","description":"Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection.\n\nThis issue affects oPanel: before 1.20.66.","summary":"Osbil Technology's oPanel server control panel fails to neutralize special characters in input passed to OS commands, which is an OS command injection flaw. An attacker who can reach the panel may be able to run arbitrary commands on the host.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["opanel","osbil","other","self-hosted","server-admin"],"not_affected_if":["version-1.20.66-or-later"],"how_to_check":"- Check the installed oPanel version in the panel or its install directory; unknown if the sources give the exact location.\n- Confirm whether the panel is reachable from the internet or untrusted networks.","fix":"- oPanel: move to `1.20.66` or later.","status":"open","published_at":"2026-11-09T14:17:16+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","triaged_at":"2026-11-09T14:27:38+00:00","updated_at":"2026-11-09T14:27:38+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-09T14:27:38Z","model":"claude-haiku-5-5","output":{"fix":"- oPanel: move to `1.20.66` or later.","reach":"unknown","title":"Osbil oPanel: OS command injection before 1.20.66 lets attackers run commands","impact":"high","summary":"Osbil Technology's oPanel server control panel fails to neutralize special characters in input passed to OS commands, which is an OS command injection flaw. An attacker who can reach the panel may be able to run arbitrary commands on the host.","audience":"businesses","category":"other","nicknames":[],"who_cares":["opanel","osbil","self-hosted","server-admin"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Commands run on the server hosting the control panel.","analyst_note":"Check the NVD entry and vendor advisory for attack vector, required privileges and the affected feature; confirm the fixed version is 1.20.66.","how_to_check":"- Check the installed oPanel version in the panel or its install directory; unknown if the sources give the exact location.\n- Confirm whether the panel is reachable from the internet or untrusted networks.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-1.20.66-or-later"],"who_is_affected":"Teams running Osbil oPanel earlier than 1.20.66 on their servers are exposed. The sources do not say whether authentication is required or which panel features are involved, so unknown whether a default install is reachable without credentials.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00072,"input_tokens":4539,"output_tokens":533,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-16283':14A,17A '-2026':13A,16A '1.20.66':7A,99C 'abl':61B 'admin':26B 'affect':96C 'allow':90C 'arbitrari':64B 'attack':9A,53B 'charact':38B 'command':4A,11A,44B,49B,65B,78C,80C,92C 'control':32B 'cve':12A,15A 'element':73C 'fail':34B 'flaw':51B 'host':23B,68B 'improp':69C 'inject':5A,50B,81C,93C 'input':40B 'issu':95C 'let':8A 'ltd':88C 'ltd.osbil':86C 'may':59B 'neutral':36B,70C 'opanel':2A,18B,30B,89C,97C 'os':3A,43B,48B,77C,79C,91C 'osbil':1A,19B,27B,84C 'panel':33B,58B 'pass':41B 'reach':56B 'run':10A,63B 'self':22B 'self-host':21B 'server':25B,31B 'server-admin':24B 'special':37B,72C 'technolog':28B,85C,87C 'use':74C 'vulner':82C","nicknames":[],"mitigations":[],"who_affected":"Teams running Osbil oPanel earlier than 1.20.66 on their servers are exposed. The sources do not say whether authentication is required or which panel features are involved, so unknown whether a default install is reachable without credentials.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","opanel","osbil","other","selfhosted","serveradmin"],"campaign_type":null,"search_a":"'-16283':14A,17A '-2026':13A,16A '1.20.66':7A 'attack':9A 'command':4A,11A 'cve':12A,15A 'inject':5A 'let':8A 'opanel':2A 'os':3A 'osbil':1A 'run':10A","search_b":"'abl':61B 'admin':26B 'arbitrari':64B 'attack':53B 'charact':38B 'command':44B,49B,65B 'control':32B 'fail':34B 'flaw':51B 'host':23B,68B 'inject':50B 'input':40B 'may':59B 'neutral':36B 'opanel':18B,30B 'os':43B,48B 'osbil':19B,27B 'panel':33B,58B 'pass':41B 'reach':56B 'run':63B 'self':22B 'self-host':21B 'server':25B,31B 'server-admin':24B 'special':37B 'technolog':28B","search_c":"'1.20.66':99C 'affect':96C 'allow':90C 'command':78C,80C,92C 'element':73C 'improp':69C 'inject':81C,93C 'issu':95C 'ltd':88C 'ltd.osbil':86C 'neutral':70C 'opanel':89C,97C 'os':77C,79C,91C 'osbil':84C 'special':72C 'technolog':85C,87C 'use':74C 'vulner':82C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T14:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"iletisim@usom.gov.tr","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16283","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16283","severity":null,"published_at":"2026-11-09T14:17:16+00:00","modified_at":"2026-11-09T14:17:16+00:00","first_seen_at":"2026-11-09T14:26:59+00:00","fetched_at":"2026-11-09T14:26:59+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}