Vulnerability Description
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain's home directory, the application returns the contents of files readable by the CyberPanel execution identity.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79304.md
- https://github.com/usmannasir/cyberpanel/blob/v1.9.1/CyberCP/secMiddleware.py#L6
- https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#
- https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/filemanager.py#
- https://github.com/usmannasir/cyberpanel/blob/v1.9.1/filemanager/views.py#L98-L1
FAQ
What is CVE-2026-79304?
CVE-2026-79304 is a vulnerability with a CVSS score of 6.5 (MEDIUM). CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domai...
How severe is CVE-2026-79304?
CVE-2026-79304 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-79304?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.