https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 10:14:27 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352840 EUVD-2026-352840 https://cve.radiocsirt.org/vuln/euvd-2026-352840 https://cve.radiocsirt.org/vuln/fkie_cve-2026-67613 <p>CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.</p> <p>CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-67613 https://cve.radiocsirt.org/vuln/ghsa-3x24-fvrh-w27x <p>CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.</p> <p>CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.</p> https://cve.radiocsirt.org/vuln/ghsa-3x24-fvrh-w27x https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2831 <p>Ein Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode mit Administratorrechten auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Informationen offenzulegen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode mit Administratorrechten auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2831