CVE-2025-66292

{"id": "CVE-2025-66292", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66292", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-15T16:44:41.979186Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "donknap", "product": "dpanel", "versions": [{"status": "affected", "version": "< 1.9.2"}]}]}], "published": "2026-01-15T17:16:04.570", "references": [{"url": "https://github.com/donknap/dpanel/commit/cbda0d90204e8212f2010774345c952e42069119", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/donknap/dpanel/releases/tag/v1.9.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/donknap/dpanel/security/advisories/GHSA-vh2x-fw87-4fxq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-73"}]}], "descriptions": [{"lang": "en", "value": "DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2."}, {"lang": "es", "value": "DPanel es un panel de gesti\u00f3n de servidor de c\u00f3digo abierto escrito en Go. Anterior a 1.9.2, DPanel tiene una vulnerabilidad de eliminaci\u00f3n arbitraria de archivos en la interfaz /api/common/attach/delete. Los usuarios autenticados pueden eliminar archivos arbitrarios en el servidor mediante salto de ruta. Cuando un usuario inicia sesi\u00f3n en el backend administrativo, esta interfaz puede usarse para eliminar archivos. La vulnerabilidad reside en la funci\u00f3n Delete dentro del archivo app/common/http/controller/attach.go. El par\u00e1metro de ruta enviado por el usuario se pasa directamente a storage.Local{}.GetSaveRealPath y, posteriormente, a os.Remove sin una sanitizaci\u00f3n adecuada o sin verificar caracteres de salto de ruta (../). Y la funci\u00f3n auxiliar en common/service/storage/local.go utiliza filepath.Join, que resuelve ../ pero no impone un chroot/jail. Esta vulnerabilidad est\u00e1 corregida en 1.9.2."}], "lastModified": "2026-06-17T09:56:37.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dpanel:dpanel:*:*:*:*:*:go:*:*", "vulnerable": true, "matchCriteriaId": "2B472AD9-9206-4EA4-A7BE-3FFA42B28FE9", "versionEndExcluding": "1.9.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}