Arbitrary File Deletion Vulnerability in DPanel by Donknap

CVE-2025-66292

What is CVE-2025-66292?

DPanel, an open-source server management panel developed in Go, contains a vulnerability that allows authenticated users to delete arbitrary files from the server through unsanitized path traversal in the /api/common/attach/delete interface. This issue originates from the Delete function, where user-supplied path parameters are inadequately handled. The affected code does not enforce proper checks during file deletion, leading to potential exploitation. This security flaw has been resolved in version 1.9.2, making it imperative for users to upgrade and safeguard their systems against unauthorized file deletion.

References