{"schema_version":"1.9.0","id":"CVE-2025-66292","published":"2026-01-15T16:19:55.507Z","modified":"2026-08-12T03:51:19.859137199Z","aliases":["GHSA-vh2x-fw87-4fxq","GO-2026-4318"],"related":["SUSE-SU-2026:0292-1","openSUSE-SU-2026:21483-1"],"summary":"DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface","details":"DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/donknap/dpanel","events":[{"introduced":"0"},{"fixed":"cc6998b714bfb9a854bf1b314f368b49462997d7"},{"fixed":"cbda0d90204e8212f2010774345c952e42069119"}],"database_specific":{"cpe":"cpe:2.3:a:dpanel:dpanel:*:*:*:*:*:go:*:*","extracted_events":[{"introduced":"0"},{"fixed":"1.9.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["v1.9.1.3","v1.9.1.2","v1.9.1.1","v1.9.1","v1.8.1.1","v1.8.1","v1.8.0","v1.7.3.2","v1.7.3.1","v1.7.3","v1.7.2","v1.7.1","toolchains-v1","v1.7.0","v1.6.4","v1.6.3.2","v1.6.3.1","v1.6.3","v1.6.1","v1.6.0","v1.5.4","v1.5.3","v1.5.2","v1.5.1","v1.5.0","v1.4.1","v1.4.0","v1.3.4","v1.3.3","v1.3.2","v1.3.1","v1.3.0","v1.2.6","v1.2.5","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.4","v1.1.3","v1.1.2","v1.1.1","v1.1.0","v1.0.4.2","v1.0.4.1","v1.0.4","v1.0.3","v1.0.2.4","v1.0.2.1","v1.0.2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-66292.json"}}],"references":[{"type":"WEB","url":"https://github.com/donknap/dpanel/releases/tag/v1.9.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66292.json"},{"type":"ADVISORY","url":"https://github.com/donknap/dpanel/security/advisories/GHSA-vh2x-fw87-4fxq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66292"},{"type":"FIX","url":"https://github.com/donknap/dpanel/commit/cbda0d90204e8212f2010774345c952e42069119"}],"database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66292.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}]}