https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 09 Nov 2026 16:10:26 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-79304 <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> https://db.gcve.eu/vuln/fkie_cve-2026-79304 https://db.gcve.eu/vuln/ghsa-gcf9-pfph-mqpw <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> <p>CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain&#39;s home directory, the application returns the contents of files readable by the CyberPanel execution identity.</p> https://db.gcve.eu/vuln/ghsa-gcf9-pfph-mqpw