CVE-2026-79304

CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

PT-2026-97369

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description A path traversal issue exists in the compress method exposed through the '/filemanager/controller' endpoint. An authenticated remote attacker who owns a configured domain can provide absolute or out-of-scop...

EUVD-2026-85401

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79306: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79304: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-29811

CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

CVE-2026-29810

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29810: Detection of Error Condition Without Action

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29810

CyberPanel versions prior to 2.4.4 contain a business-logic flaw where a required return 0 statement is omitted, leading to an incomplete authorization or validation check. The vulnerability is exploitable over the network with low complexity and requires low privileges (an authenticated account)...

CVE-2026-29812

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

CVE-2026-29810

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29812: Insufficient Logging

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list...

PT-2026-90949

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29810

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...

CVE-2026-29810

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic...