CVE-2026-79304CWE-22path-traversal

CVE-2026-79304

Medium · published September 23, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
44.5
In the wild
Unconfirmed
What it is

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain's home directory, the application returns the contents of files readable by the CyberPanel execution identity.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00539 · 44.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-09-23T20:16Z
References (5)
https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79304.md · [email protected]https://github.com/usmannasir/cyberpanel/blob/v1.9.1/CyberCP/secMiddleware.py#L67-L70 · [email protected]https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#L20-L27 · [email protected]https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#L267-L276 · [email protected]https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/views.py#L98-L135 · [email protected]
EPSS history
Timeline
  • 25 SEP 03:27Z
    EPSS moved — → 0%
    epss
  • 23 SEP 00:00Z
    CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint
    cvelistv5