This is a critical privilege escalation in CyberPanel's remote backup feature. An authenticated administrator can achieve persistent root access by supplying an attacker-controlled SSH public key during backup configuration. The system retrieves the key from a user-supplied source and writes it directly to /root/.ssh/authorized_keys without validation — no fingerprint verification, no keytype enforcement, no confirmation step. Any authenticated user with access to the backup configuration page effectively owns the server.
The vulnerability isn't a missing validation check — it's a collapsed trust boundary. The remote backup feature requires root-level SSH access to function, but CyberPanel grants this access based solely on application authentication. The developers treated "authenticated administrator" as equivalent to "authorized for root operations," and the authorized_keys injection compounds the severity from one-time code execution to permanent backdoor.
What makes this worse: CyberPanel doesn't manage a single server. It manages dozens or hundreds of customer domains, databases, email accounts, SSL certificates, and DNS. Compromising a CyberPanel instance gives the attacker access to credentials stored for every managed service — not just one root shell, but a pivot to customer data across all tenants. This isn't just high-severity; it's an infrastructure-level incident waiting to happen.
Defenders should act immediately. Disable remote backup configuration if unused. Audit /root/.ssh/authorized_keys for unexpected keys — any entry you didn't manually add is hostile. If remote backups are necessary, isolate the CyberPanel instance network-wise and monitor authorized_keys for changes using file integrity tools. Treat any authenticated CyberPanel account as a highest-privilege credential, because the application architecture conflates admin authentication with root authorization.
The CVSS 8.8 understates the real impact. The score measures technical severity, not blast radius. A vulnerability that grants persistent root plus credential access to every tenant on the platform is operationally critical regardless of the vector score.