PT-2026-97368

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description An authenticated remote attacker with ownership of any configured domain can access files outside the intended directory. This occurs because the application validates the domainName but fails to canonicali...

EUVD-2026-85401

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79304

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

CVE-2026-79304

CyberPanel version 1.9.1 is vulnerable to a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker who owns any configured domain can exploit this by supplying an arbitrary absolute or out-of-scope path in the fileName...

PT-2026-97369

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1 Description A path traversal issue exists in the compress method exposed through the '/filemanager/controller' endpoint. An authenticated remote attacker who owns a configured domain can provide absolute or out-of-scop...

CVE-2026-77633 Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transactio...

CVE-2026-77633 Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service

Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, PrepareUpload in pkg/filemanager/fs/dbfs/upload.go checks a stale in-memory user storage value through validateUserCapacity and later applies an unconditional storage charge outside the same quota-enforcing transactio...

CVE-2026-94104 NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager

NivoCart through 2.4.0 contains an arbitrary file upload vulnerability in the File Manager multi endpoint that fails to validate file extensions for new filenames or when chunks parameter is 2 or higher. Attackers with view-only back-office access can upload PHP files to the web-accessible...

CVE-2023-26563-26564-26565

The vendor has reportedly fixed all vulnerabilities detailed as of releases made after 2024. Ruptura InfoSecurity has not verified that these fixes are complete. See vendor comments in https://github.com/RupturaInfoSec/CVE-2023-26563-26564-26565/issues/1. CVE-2023-26563 - Local File Read in ASPCo...

Exploit for CVE-2024-21546

UniSharp Laravel Filemanager Unauthenticated RCE CVE-2024-215...

CVE-2026-18788

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-18788

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

CVE-2026-18788 Trippo ResponsiveFilemanager dialog.php unrestricted upload

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

PT-2026-67787

Name of the Vulnerable Software and Affected Versions Trippo ResponsiveFilemanager versions prior to 9.14.1 Description A remote flaw exists in an unknown function within the filemanager/dialog.php file. This issue allows for unrestricted upload of files to the server. Recommendations At the...

CVE-2026-18788: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in Trippo ResponsiveFilemanager up to 9.14.0. The impacted element is an unknown function of the file filemanager/dialog.php. The manipulation results in unrestricted upload. The attack may be performed from remote. The exploit has been released to the public a...

Tiny File Manager Panel - Detect

Tiny File Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tiny File Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tiny File Manager Panel - Detect', 'description...