donknap dpanel up to 1.7.2 get-from-uri GetFromUri file inclusion

Summaryinfo

A vulnerability categorized as problematic has been discovered in donknap dpanel up to 1.7.2. Affected is the function GetFromUri of the file /api/app/compose/get-from-uri. Such manipulation of the argument uri leads to file inclusion. This vulnerability is documented as CVE-2025-53363. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in donknap dpanel up to 1.7.2. It has been rated as problematic. Affected by this issue is the function GetFromUri of the file /api/app/compose/get-from-uri. The manipulation of the argument uri with an unknown input leads to a file inclusion vulnerability. Using CWE to declare the problem leads to CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. Impacted is confidentiality. CVE summarizes:

dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-53363 since 06/27/2025. The exploitation is known to be easy. The attack may be launched remotely. The exploitation needs additional levels of successful authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/22/2025).

It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-25585). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• donknap

Name

• dpanel

Version

• 1.7.0
• 1.7.1
• 1.7.2

Website

• Product: https://github.com/donknap/dpanel/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion