https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 10:10:46 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-375436 EUVD-2026-375436 https://cve.radiocsirt.org/vuln/euvd-2026-375436 https://cve.radiocsirt.org/vuln/fkie_cve-2026-79304 <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-79304 https://cve.radiocsirt.org/vuln/ghsa-gcf9-pfph-mqpw <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> https://cve.radiocsirt.org/vuln/ghsa-gcf9-pfph-mqpw https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3561 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in CyberPanel ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3561