CVE-2026-25069CWE-22

SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion

Critical · published January 31, 2026

CVSS v4.0
9.3
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can disclose sensitive information and delete critical system files, resulting in data loss and potential system compromise or denial of service.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-01-31T23:46Z
EPSS history
Timeline
  • 31 JAN 23:46Z
    SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion
    cvelistv5