VYPR
← All advisories
High severityOSV Advisory· Published Jan 15, 2026· Updated Jan 15, 2026

DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

CVE-2025-66292

Description

DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/donknap/dpanelGo
< 1.9.21.9.2

Affected products

1

Patches

1
cbda0d90204e

fix CVE-2025-66292

https://github.com/donknap/dpaneldonknap@gmail.comDec 1, 2025via ghsa
commit
1 file changed · +13 −4
  • app/common/http/controller/attach.go+13 −4 modified
    @@ -1,7 +1,6 @@
 package controller
 
 import (
-	"fmt"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -51,11 +50,21 @@ func (self Attach) Delete(http *gin.Context) {
 	if !self.Validate(http, &params) {
 		return
 	}
+	if !filepath.IsLocal(params.Path) {
+		self.JsonResponseWithError(http, function.ErrorMessage(define.ErrorMessageCommonDataNotFoundOrDeleted), 500)
+		return
+	}
+	params.Path = filepath.Clean(params.Path)
 	path := storage.Local{}.GetSaveRealPath(params.Path)
-	fmt.Printf("%v \n", path)
 	_, err := os.Stat(path)
-	if err == nil {
-		os.Remove(path)
+	if err != nil {
+		self.JsonResponseWithError(http, err, 500)
+		return
+	}
+	err = os.Remove(path)
+	if err != nil {
+		self.JsonResponseWithError(http, err, 500)
+		return
 	}
 	self.JsonSuccessResponse(http)
 	return

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.