Path Traversal in CyberPanel File Manager

Executive Summary

CVE-2026-79304 is a path traversal vulnerability in CyberPanel 1.9.1. It allows an authenticated remote attacker who owns a configured domain to read arbitrary files outside their site directory by supplying an absolute or out-of-scope path in the fileName parameter. The application fails to validate if the requested file is within the domain's home directory.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unauthorized file access attempts in CyberPanel logs. Check for requests to the /filemanager/controller endpoint with fileName parameters containing absolute paths or path traversal sequences like '../'. Use tools like grep to search logs for suspicious patterns: grep -r 'fileName' /var/log/cyberpanel/ or tail -f /var/log/nginx/access.log | grep '/filemanager/controller'.

Useful 0 Not Useful 0

Impact Analysis

An attacker could access sensitive files such as configuration files, database credentials, logs, or other site data. This could lead to data breaches, unauthorized access to other websites hosted on the same server, or further exploitation of the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of compliance certifications.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately restrict access to the /filemanager/controller endpoint via firewall rules or disable it if unused. Implement a Web Application Firewall (WAF) to block path traversal attempts. Monitor for unusual file access patterns and review user permissions to ensure only authorized users have site-level access. Consider isolating CyberPanel in a DMZ until patched.

Useful 0 Not Useful 0