CVE-2025-66292
BaseFortify
Publication date: 2026-01-15
Last updated on: 2026-03-12
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dpanel | dpanel | to 1.9.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-73 | The product allows user input to control or influence paths or file names that are used in filesystem operations. |
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-66292 is an arbitrary file deletion vulnerability in DPanel versions prior to 1.9.2. Authenticated users can exploit a path traversal flaw in the /api/common/attach/delete interface to delete arbitrary files on the server. The vulnerability occurs because the user-supplied file path is not properly sanitized or validated, allowing traversal outside the intended directory and deletion of files via os.Remove. This is due to insufficient checks against path traversal sequences like '../' and lack of a chroot or jail environment enforcement. [1]
How can this vulnerability impact me? :
This vulnerability can allow an authenticated user with low privileges to delete arbitrary files on the server, potentially leading to denial of service or disruption of critical services by removing important files. It impacts the integrity and availability of the system, as attackers can delete files outside the intended directory, causing system instability or data loss. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unauthorized or suspicious POST requests to the /api/common/attach/delete interface on the DPanel server, especially those containing path traversal sequences like "../" in the path parameter. A proof of concept involves logging into the DPanel dashboard to obtain an authorization token, then sending a crafted POST request to delete arbitrary files. To detect exploitation attempts, you can use network monitoring tools or web server logs to look for such requests. For example, using curl to test the vulnerability (only on authorized test systems): curl -X POST -H "Authorization: Bearer <token>" -d '{"path":"../../../../../../../../tmp/1.txt"}' https://<dpanel-server>/dpanel/api/common/attach/delete Additionally, you can search server logs for POST requests to /api/common/attach/delete containing ".." sequences in the path parameter to identify potential exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include: 1. Upgrade DPanel to version 1.9.2 or later, where the vulnerability is fixed. 2. If upgrading immediately is not possible, restrict access to the /api/common/attach/delete interface to trusted users only. 3. Monitor and block suspicious requests containing path traversal sequences in the path parameter. 4. Apply network-level controls such as firewall rules to limit access to the administrative backend. 5. Review and implement the patch described in the fix, which includes path validation using filepath.IsLocal, path sanitization with filepath.Clean, and improved error handling to prevent arbitrary file deletion. Upgrading to version 1.9.2 is the most effective and recommended step to fully mitigate the vulnerability. [2, 3]