251 matches found
CVE-2026-79304: Improper Limitation of a Pathname to a Restricted Directory
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...
CVE-2026-79304
CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...
EUVD-2026-85402
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-79306: Improper Limitation of a Pathname to a Restricted Directory
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-79306
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-79304
CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...
PT-2026-97369
Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description A path traversal issue exists in the compress method exposed through the '/filemanager/controller' endpoint. An authenticated remote attacker who owns a configured domain can provide absolute or out-of-scop...
CVE-2026-79306
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...
CVE-2026-79306
CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...
CVE-2026-29812
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29811
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
CVE-2026-29810
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
EUVD-2026-77075
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
EUVD-2026-77076
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29810: Detection of Error Condition Without Action
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...
CVE-2026-29811: Comparison Using Wrong Factors
CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...
CVE-2026-29812
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29812: Insufficient Logging
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...
CVE-2026-29811
CyberPanel versions prior to 2.4.4 are affected by a vulnerability in how the application detects an "alias" domain (a secondary domain serving the same content as a primary domain). The root cause is that this detection is performed via an ORM query filter rather than a Python if statement, whic...