CVE-2025-66292

Katalog CVE

CVSS 8.1 · High EPSS 0,65%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada dpanel. Skor CVSS 3.1 8.1 (High) menurut github.com.

Deskripsi (NVD)

DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.

Rincian

Terbit di NVD

15 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.1 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,65% peluang dieksploitasi; lebih tinggi dari 49,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/donknap/dpanel/security/advisories/GHSA-vh2x-fw87-4fxq exploit · advisory vendor
• https://github.com/donknap/dpanel/commit/cbda0d90204e8212f2010774345c952e42069119 patch
• https://github.com/donknap/dpanel/releases/tag/v1.9.2 release notes