https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 08:46:02 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265820 EUVD-2026-265820 https://cve.radiocsirt.org/vuln/euvd-2026-265820 https://cve.radiocsirt.org/vuln/fkie_cve-2025-66292 <p>DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.</p> <p>DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-66292 https://cve.radiocsirt.org/vuln/ghsa-vh2x-fw87-4fxq <p><strong>Affected:</strong> Go: github.com/donknap/dpanel</p> <p>### Summary DPanel has an arbitrary file deletion vulnerability in the `/api/common/attach/delete` interface. Authenticated users can delete arbitrary files on the server via path traversal.</p> <p>### Details When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the `Delete` function within the `app/common/http/controller/attach.go` file.</p> <p>The `path` parameter submitted by the user is directly passed to `storage.Local{}.GetSaveRealPath` and subsequently to `os.Remove` without proper sanitization or checking for path traversal characters (`../`).</p> <p>The vulnerable code snippet: &lt;img width=&#34;487&#34; height=&#34;363&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/b811de6f-1df1-49f3-af78-ea77bc420804&#34; /&gt;</p> <p>And the helper function in `common/service/storage/local.go` uses `filepath.Join`, which resolves `../` but does not enforce a chroot/jail: &lt;img width=&#34;564&#34; height=&#34;66&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/84d5a4f7-9054-4e1d-aa6b-6b50c80ba277&#34; /&gt;</p> <p>### PoC 1. Log in to the DPanel dashboard to obtain the `Authorization` token. 2. Send a POST request to delete a file (e.g., `/tmp/1.txt` inside the container).</p> <p>**Request:** ```http POST /dpanel/api/common/attach/delete HTTP/1.1 Host: target-ip:8807 Authorization: Bearer &lt;YOUR_TOKEN&gt; Content-Type: application/x-www-form-urlencoded</p> <p>path=../../../../../../../../tmp/1.txt ```</p> <p>&lt;img width=&#34;1600&#34; height=&#34;940&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-…</p> <p><strong>Affected:</strong> Go: github.com/donknap/dpanel</p> <p>### Summary DPanel has an arbitrary file deletion vulnerability in the `/api/common/attach/delete` interface. Authenticated users can delete arbitrary files on the server via path traversal.</p> <p>### Details When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the `Delete` function within the `app/common/http/controller/attach.go` file.</p> <p>The `path` parameter submitted by the user is directly passed to `storage.Local{}.GetSaveRealPath` and subsequently to `os.Remove` without proper sanitization or checking for path traversal characters (`../`).</p> <p>The vulnerable code snippet: &lt;img width=&#34;487&#34; height=&#34;363&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/b811de6f-1df1-49f3-af78-ea77bc420804&#34; /&gt;</p> <p>And the helper function in `common/service/storage/local.go` uses `filepath.Join`, which resolves `../` but does not enforce a chroot/jail: &lt;img width=&#34;564&#34; height=&#34;66&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/84d5a4f7-9054-4e1d-aa6b-6b50c80ba277&#34; /&gt;</p> <p>### PoC 1. Log in to the DPanel dashboard to obtain the `Authorization` token. 2. Send a POST request to delete a file (e.g., `/tmp/1.txt` inside the container).</p> <p>**Request:** ```http POST /dpanel/api/common/attach/delete HTTP/1.1 Host: target-ip:8807 Authorization: Bearer &lt;YOUR_TOKEN&gt; Content-Type: application/x-www-form-urlencoded</p> <p>path=../../../../../../../../tmp/1.txt ```</p> <p>&lt;img width=&#34;1600&#34; height=&#34;940&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-…</p> https://cve.radiocsirt.org/vuln/ghsa-vh2x-fw87-4fxq