https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T10:30:28.153106+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265820 EUVD-2026-265820 2026-10-07T10:30:28.201738+00:00 EUVD-2026-265820 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66292 fkie_cve-2025-66292 2026-10-07T10:30:28.201776+00:00

DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.

 https://cve.radiocsirt.org/vuln/ghsa-vh2x-fw87-4fxq GHSA-vh2x-fw87-4fxq — DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface 2026-10-07T10:30:28.201813+00:00

Affected: Go: github.com/donknap/dpanel

### Summary DPanel has an arbitrary file deletion vulnerability in the `/api/common/attach/delete` interface. Authenticated users can delete arbitrary files on the server via path traversal.

### Details When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the `Delete` function within the `app/common/http/controller/attach.go` file.

The `path` parameter submitted by the user is directly passed to `storage.Local{}.GetSaveRealPath` and subsequently to `os.Remove` without proper sanitization or checking for path traversal characters (`../`).

The vulnerable code snippet: <img width="487" height="363" alt="image" src="https://github.com/user-attachments/assets/b811de6f-1df1-49f3-af78-ea77bc420804" />

And the helper function in `common/service/storage/local.go` uses `filepath.Join`, which resolves `../` but does not enforce a chroot/jail: <img width="564" height="66" alt="image" src="https://github.com/user-attachments/assets/84d5a4f7-9054-4e1d-aa6b-6b50c80ba277" />

### PoC 1. Log in to the DPanel dashboard to obtain the `Authorization` token. 2. Send a POST request to delete a file (e.g., `/tmp/1.txt` inside the container).

**Request:** ```http POST /dpanel/api/common/attach/delete HTTP/1.1 Host: target-ip:8807 Authorization: Bearer <YOUR_TOKEN> Content-Type: application/x-www-form-urlencoded

path=../../../../../../../../tmp/1.txt ```

<img width="1600" height="940" alt="image" src="https://github.com/user-…