Description
dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.
Problem types
CWE-73: External Control of File Name or Path
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Product status
References
github.com/...dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q
