CVE-2026-79304

Deferred Deferred - Pending Action

Path Traversal in CyberPanel File Manager

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: MITRE

Description

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because authorization validates only domainName and does not canonicalize or restrict fileName to that domain's home directory, the application returns the contents of files readable by the CyberPanel execution identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-10-14

AI Q&A

2026-09-23

EPSS Evaluated

2026-10-12

NVD

CVE-2026-79304

EUVD

EUVD-2026-85401

Affected Vendors & Products

Vendor	Product	Version / Range
usmannasir	cyberpanel	1.9.1
cyberpanel	cyberpanel	1.9.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

CVE-2026-79304 is a path traversal vulnerability in CyberPanel 1.9.1. It allows an authenticated remote attacker who owns a configured domain to read arbitrary files outside their site directory by supplying an absolute or out-of-scope path in the fileName parameter. The application fails to validate if the requested file is within the domain's home directory.

Detection Guidance

To detect this vulnerability, monitor for unauthorized file access attempts in CyberPanel logs. Check for requests to the /filemanager/controller endpoint with fileName parameters containing absolute paths or path traversal sequences like '../'. Use tools like grep to search logs for suspicious patterns: grep -r 'fileName' /var/log/cyberpanel/ or tail -f /var/log/nginx/access.log | grep '/filemanager/controller'.

Impact Analysis

An attacker could access sensitive files such as configuration files, database credentials, logs, or other site data. This could lead to data breaches, unauthorized access to other websites hosted on the same server, or further exploitation of the system.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Mitigation Strategies

Immediately restrict access to the /filemanager/controller endpoint via firewall rules or disable it if unused. Implement a Web Application Firewall (WAF) to block path traversal attempts. Monitor for unusual file access patterns and review user permissions to ensure only authorized users have site-level access. Consider isolating CyberPanel in a DMZ until patched.

Hi! I’m here to help you understand CVE-2026-79304. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70