PT-2025-34374 · Dpanel · Dpanel

Ltltlxey · Published 2025-08-22 · Updated 2025-08-29 · CVE-2025-53363

Positive Technologies (AI Summary)

CVSS v4.0

6.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: dpanel versions 1.2.0 through 1.7.2

Description: dpanel is a server management panel written in Go. Versions of the software allow authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The issue resides in the GetFromUri function within app/application/http/controller/compose.go, where the uri parameter is directly passed to os.ReadFile without sufficient validation or access control. This can lead to information disclosure as a logged-in attacker can read sensitive files from the host system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-73

CWE-22

Related Identifiers

CVE-2025-53363

GHSA-GCQF-PXGG-GW8Q

GO-2025-3909

Affected Products

Dpanel

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53363.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53363 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53363 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3909 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gcqf-pxgg-gw8q · Vendor Advisory
• https://github.com/donknap/dpanel · Note
• https://github.com/donknap/dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q · Note
• https://pkg.go.dev/vuln/GO-2025-3909 · Note
• https://twitter.com/CVEnew/status/1958915322942984679 · Twitter Post