Approved changes feed: RSS · Atom
cpe:2.3:a:dpanel:dpanel:*:*:*:*:*:go:*:*part: a version: * update: *
| Vendor | Dpanel (76373fa9-ac9f-556b-b63d-300fa98e5c84) |
|---|---|
| Product | Dpanel (9e781ab2-92f3-59f0-878a-97f43a50b063) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | go |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/donknap/dpanel |
purl2cpe | 2026-07-28 16:40:57.827464 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-66292 |
vulnerable | 2026-06-08 07:41:18.551593 |
DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface
HIGH (8.1)
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.
Published: 2026-01-15T16:19:55.507Z
Updated: 2026-01-15T16:44:51.018Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.