CVE-2026-79304 Details
Description
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain's home directory, the application returns the contents of files readable by the CyberPanel execution identity.
A path traversal vulnerability has been identified in CyberPanel version 1.9.1. The issue resides in the file manager's readFileContents method within the filemanager controller endpoint. This vulnerability allows authenticated remote attackers, who own any configured domain, to manipulate the fileName JSON property to include arbitrary absolute or out-of-scope paths. The lack of proper authorization checks and path validation enables the application to return the contents of files accessible by the CyberPanel execution identity, potentially exposing sensitive information such as configuration files, database credentials, and logs.
Users are advised to upgrade to a version of CyberPanel that includes the site directory containment check. If an immediate upgrade is not possible, file-read requests carrying absolute paths or dot-dot sequences should be blocked at the reverse proxy or WAF layer.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| CyberPanel | 1.9.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |