CVE-2025-53363: Github.com/donknap/dpanel Dpanel Has An Arbitrary File Vulnerability
MODERATECVE-2025-53363 is a MODERATE dpanel has an arbitrary file vulnerability (CWE-73: External Control of File Name or Path) affecting Github.com/donknap/dpanel libraries in the Go ecosystem. The issue involves dpanel has an arbitrary file read vulnerability. Remediation is available in the latest vendor maintenance releases.
CVE-2025-53363 at a Glance
How to Fix CVE-2025-53363
To remediate this vulnerability, upgrade all affected Github.com/donknap/dpanel dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/donknap/dpanel to Latest secure releaseRun the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/donknap/dpanelHow to Check if You Are Affected
To determine whether your application is affected by CVE-2025-53363, inspect your project dependencies for Github.com/donknap/dpanel:
inspect dependencies for github.com/donknap/dpanelAnalyze the terminal output to locate any version of Github.com/donknap/dpanel in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-73: External Control of File Name or Path, where the product allows user input to control or influence paths or file names that are used in filesystem operations. In Github.com/donknap/dpanel, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2025-53363 Affected Github.com/donknap/dpanel Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/donknap/dpanel
|
Go |
≥ 1.2.0
≤ 1.7.2
|
|
References
Frequently Asked Questions
What is CVE-2025-53363?
Which Github.com/donknap/dpanel versions are affected?
What version fixes CVE-2025-53363?
Is github.com/donknap/dpanel affected?
What CWE is associated with CVE-2025-53363?
How can I check Go dependencies for CVE-2025-53363?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-gcqf-pxgg-gw8q",
"modified" : "2025-08-29T20:34:31Z",
"published" : "2025-08-22T16:49:05Z",
"aliases" : [ "CVE-2025-53363" ],
"summary" : "Dpanel has an arbitrary file read vulnerability",
"details" : "### Summary\nDpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.\n\n### Details\nWhen a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling.\n\n\n\n### PoC\n```text\nPOST /api/app/compose/get-from-uri HTTP/1.1\nHost: x.x.x.x\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:136.0) Gecko/20100101 Firefox/136.0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\nAccept-Encoding: gzip, deflate\nAuthorization: Bearer eyJ......lWg==\nConnection: close\nContent-Type: application/json\nContent-Length: 21\n\n{\"uri\":\"/etc/passwd\"}\n```\n\n### Impact\nThis vulnerability could lead to the leakage of sensitive server file information. In versions from 1.2.0 up to the latest (1.7.2), logged-in users can make requests to this interface.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/donknap/dpanel"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.2.0"
}, {
"last_affected" : "1.7.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/donknap/dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-53363"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/donknap/dpanel"
}, {
"type" : "WEB",
"url" : "https://pkg.go.dev/vuln/GO-2025-3909"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-73" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2025-08-22T16:49:05Z",
"nvd_published_at" : "2025-08-22T16:15:44Z"
}
}