Executive Summary

CVE-2025-66292 is an arbitrary file deletion vulnerability in DPanel versions prior to 1.9.2. Authenticated users can exploit a path traversal flaw in the /api/common/attach/delete interface to delete arbitrary files on the server. The vulnerability occurs because the user-supplied file path is not properly sanitized or validated, allowing traversal outside the intended directory and deletion of files via os.Remove. This is due to insufficient checks against path traversal sequences like '../' and lack of a chroot or jail environment enforcement. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user with low privileges to delete arbitrary files on the server, potentially leading to denial of service or disruption of critical services by removing important files. It impacts the integrity and availability of the system, as attackers can delete files outside the intended directory, causing system instability or data loss. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized or suspicious POST requests to the /api/common/attach/delete interface on the DPanel server, especially those containing path traversal sequences like "../" in the path parameter. A proof of concept involves logging into the DPanel dashboard to obtain an authorization token, then sending a crafted POST request to delete arbitrary files. To detect exploitation attempts, you can use network monitoring tools or web server logs to look for such requests. For example, using curl to test the vulnerability (only on authorized test systems): curl -X POST -H "Authorization: Bearer <token>" -d '{"path":"../../../../../../../../tmp/1.txt"}' https://<dpanel-server>/dpanel/api/common/attach/delete Additionally, you can search server logs for POST requests to /api/common/attach/delete containing ".." sequences in the path parameter to identify potential exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1. Upgrade DPanel to version 1.9.2 or later, where the vulnerability is fixed. 2. If upgrading immediately is not possible, restrict access to the /api/common/attach/delete interface to trusted users only. 3. Monitor and block suspicious requests containing path traversal sequences in the path parameter. 4. Apply network-level controls such as firewall rules to limit access to the administrative backend. 5. Review and implement the patch described in the fix, which includes path validation using filepath.IsLocal, path sanitization with filepath.Clean, and improved error handling to prevent arbitrary file deletion. Upgrading to version 1.9.2 is the most effective and recommended step to fully mitigate the vulnerability. [2, 3]

Useful 0 Not Useful 0