CVE-2026-79306 Details
Description
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property, together with attacker-controlled basePath and compressedFileName values, in a method=compress request. Because the application validates only domain ownership and does not canonicalize or restrict these paths to the authorized site directory, the backend appends them to zip or tar archive commands and executes them as the website externalApp user, allowing disclosure of arbitrary readable files through the generated archive.
A path traversal vulnerability has been identified in CyberPanel version 1.9.1. This vulnerability allows authenticated remote attackers, who own any configured domain, to exploit the file manager's compression feature. The issue arises because the application fails to properly validate and restrict file paths to the authorized site directory. Instead, it only checks domain ownership. As a result, attackers can manipulate file paths to access arbitrary readable files on the server. The vulnerability is located in the file manager component, specifically within the archive compression operation.
Users are advised to upgrade to a version of CyberPanel that includes the site directory validation check. If an immediate upgrade is not possible, compression requests containing absolute paths or directory traversal sequences should be blocked at the reverse proxy or Web Application Firewall (WAF) level.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 23, 2026CISA-ADP
Assessed Sep 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| CyberPanel | 1.9.1 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | CVE Modified | CISA-ADP |
| Sep 23, 2026 | New CVE Received | [email protected] |