Information Disclosure Vulnerability in dpanel by Donknap

CVE-2025-53363

What is CVE-2025-53363?

dpanel, an open-source server management panel developed in Go, contains a flaw in its API that permits authenticated users to access arbitrary files on the server. The vulnerability arises from insufficient validation or restriction of the 'uri' parameter used in the '/api/app/compose/get-from-uri' endpoint. As a result, an attacker with valid login credentials can exploit this weakness to retrieve sensitive files from the server, potentially compromising confidential information. Users are advised to review their configurations and implement additional security measures, as no patches have been released for affected versions as of now.

References