CVE-2026-79306 in CyberPanel
Summary
by MITRE • 09/23/2026
CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property, together with attacker-controlled basePath and compressedFileName values, in a method=compress request. Because the application validates only domain ownership and does not canonicalize or restrict these paths to the authorized site directory, the backend appends them to zip or tar archive commands and executes them as the website externalApp user, allowing disclosure of arbitrary readable files through the generated archive.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/23/2026
CyberPanel version 1.9.1 is susceptible to a critical path traversal vulnerability within its file management subsystem, specifically affecting the compress functionality exposed via the /filemanager/controller endpoint. This security flaw arises from insufficient input validation and sanitization mechanisms when processing user-supplied data for archive creation operations. The vulnerability allows an authenticated remote attacker who holds ownership of any configured domain on the server to manipulate the underlying system commands used to generate compressed archives, leading to unauthorized access to sensitive files outside the intended web root directory structure.
The technical core of this flaw lies in how the application handles parameters passed during a method=compress request. Specifically, the listOfFiles JSON property, along with attacker-controlled basePath and compressedFileName values, are directly concatenated into shell commands for zip or tar utilities without proper canonicalization or boundary checks. While the application verifies that the requesting user owns the domain associated with the operation, it fails to ensure that the file paths provided remain within the authorized site directory scope. This oversight permits the injection of absolute paths such as /etc/passwd or relative sequences like ../../../../var/log/auth.log into the command string, effectively bypassing any intended sandbox restrictions imposed by the web server configuration.
From an operational perspective, this vulnerability enables arbitrary file disclosure for any readable files accessible to the website externalApp user account under which CyberPanel processes these requests. An attacker can leverage this capability to exfiltrate sensitive system configurations, database credentials stored in plain text within application config files, private keys associated with SSL certificates, or other critical infrastructure data residing on the host machine. The impact is severe because it compromises not only individual domain security but potentially the entire server environment if privileged information is retrieved and exploited further for lateral movement or privilege escalation attacks against other services running under less restrictive permissions.
This vulnerability aligns closely with CWE-22, which defines Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal. The exploitation technique involves manipulating input parameters to escape the intended directory context and access resources outside the designated sandbox area. In terms of attack classification under MITRE ATT&CK frameworks, this behavior corresponds to T1083 File and Directory Discovery, where adversaries search for sensitive information on compromised systems to facilitate subsequent stages of an intrusion campaign such as credential harvesting or data staging before exfiltration.
Mitigation strategies should prioritize immediate patching to the latest stable version of CyberPanel where these input validation issues have been addressed by the development team. Administrators must ensure that all software components are updated regularly to incorporate security fixes released upstream. Additionally, implementing strict file path canonicalization on the server side before passing arguments to system utilities can prevent traversal sequences from being interpreted correctly by underlying commands. Restricting the permissions of the externalApp user account to limit read access only to necessary domain-specific directories further reduces the blast radius in case similar vulnerabilities are discovered in future releases. Network-level controls such as web application firewalls may also help detect and block malformed requests attempting path traversal patterns, although they should not be relied upon as a primary defense mechanism given their potential for false positives and configuration complexity.