The vulnerability allows any authenticated user to invoke /api/core/tasks/start and trigger InstallPlugin, UnInstallPlugin, or UpgradeAll tasks. The plugin name and version fields are used unvalidated to build a pip package specification, and the task worker runs pip with root privileges. Thus a low‑privileged account can install, remove, or upgrade arbitrary Python packages on the host, achieving execution with root rights and full compromise.

Ajenti server administration panel (ajenti:ajenti) prior to version 2.2.16. All installations of Ajenti that have not applied the 2.2.16 release are vulnerable.

The CVSS score of 9.9 marks this as critical. EPSS data is unavailable, but the lack of enforcement of plugin‑management authorization and the worker’s root execution make exploitation straightforward once an attacker has access to the authenticated API. The vulnerability is not listed in CISA KEV yet but could be targeted by attackers immediately. The likely attack vector is a remote authenticated request to the API, though an attacker already in the local network could also trigger the tasks.