CVE-2026-79306
Received Received - Intake

Path Traversal in CyberPanel File Manager

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: MITRE

Description
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property, together with attacker-controlled basePath and compressedFileName values, in a method=compress request. Because the application validates only domain ownership and does not canonicalize or restrict these paths to the authorized site directory, the backend appends them to zip or tar archive commands and executes them as the website externalApp user, allowing disclosure of arbitrary readable files through the generated archive.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-79306
EUVD
EUVD-2026-85402

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
cyberpanel cyberpanel 1.9.1
usmannasir cyberpanel 1.9.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CyberPanel v1.9.1 has a path traversal vulnerability in its file compression feature. An authenticated attacker who owns a domain can manipulate file paths to access files outside their authorized directory. The application fails to properly validate these paths before using them in archive commands, allowing the attacker to read sensitive files on the server.

Detection Guidance

To detect this vulnerability, monitor for suspicious archive compression requests in CyberPanel's filemanager logs. Check for requests to /filemanager/controller with method=compress containing absolute paths or '..' in listOfFiles, basePath, or compressedFileName parameters. Use commands like: grep -r 'method=compress' /var/log/cyberpanel/ or tail -f /var/log/nginx/access.log | grep -i compress. Also inspect network traffic for POST requests to the filemanager endpoint with unusual payloads.

Impact Analysis

This vulnerability allows attackers to read arbitrary files on the server, including configuration files, database credentials, logs, and other sensitive data. It can expose confidential information even in multi-tenant environments where different sites are hosted on the same server.

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR and HIPAA. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to meet regulatory standards for data security and access controls.

Mitigation Strategies

Immediately block compression requests with absolute paths or '..' at the reverse proxy or WAF layer. Disable the filemanager compression feature if not essential. Upgrade to the development branch which includes path containment checks. Temporarily restrict filemanager access to trusted IPs. Review logs for signs of exploitation and revoke any unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79306. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart