Vulnerabilities in pkg:golang/github.com/donknap/dpanel

PACKAGE
Advisory Identifier: GHSA-vh2x-fw87-4fxq
Share
Advisory Summary

CVE-2025-66292 is a HIGH (CVSS 8.1) dpanel has an arbitrary file vulnerability (CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')) affecting Github.com/donknap/dpanel libraries in the Go ecosystem. The issue involves dpanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface. Remediation is available by upgrading affected packages to version 1.9.2.

3 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:golang/github.com/donknap/dpanel

3 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:golang/github.com/donknap/dpanel. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-vh2x-fw87-4fxq CVE-2025-66292 HIGH DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface
GHSA-gcqf-pxgg-gw8q CVE-2025-53363 MODERATE Dpanel has an arbitrary file read vulnerability
GHSA-j752-cjcj-w847 CVE-2025-30206 CRITICAL Dpanel's hard-coded JWT secret leads to remote code execution

CVE-2025-66292 at a Glance

CVE Identifier CVE-2025-66292
GHSA Identifier GHSA-vh2x-fw87-4fxq
Severity HIGH
CVSS v3.1 Base Score 8.1
CWE Classification CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Product Github.com/donknap/dpanel
Package Ecosystem Go
Published Date
Last Updated

Security Impact

CVSS: 8.1

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2025-66292

To remediate this vulnerability, upgrade all affected Github.com/donknap/dpanel dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/donknap/dpanel fixed: 1.9.2 
Upgrade github.com/donknap/dpanel to 1.9.2
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/donknap/dpanel

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-66292, inspect your project dependencies for Github.com/donknap/dpanel:

inspect dependencies for github.com/donknap/dpanel

Analyze the terminal output to locate any version of Github.com/donknap/dpanel in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.9.2), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), where the product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. In Github.com/donknap/dpanel, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary DPanel has an arbitrary file deletion vulnerability in the `/api/common/attach/delete` interface. Authenticated users can delete arbitrary files on the server via path traversal. ### Details When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the `Delete` function within the `app/common/http/controller/attach.go` file. The `path` parameter submitted by the user is directly passed to `storage.Local{}.GetSaveRealPath` and subsequently to `os.Remove` without proper sanitization or checking for path traversal characters (`../`). The vulnerable code snippet: <img width="487" height="363" alt="image" src="https://github.com/user-attachments/assets/b811de6f-1df1-49f3-af78-ea77bc420804" /> And the helper function in `common/service/storage/local.go` uses `filepath.Join`, which resolves `../` but does not enforce a chroot/jail: <img width="564" height="66" alt="image" src="https://github.com/user-attachments/assets/84d5a4f7-9054-4e1d-aa6b-6b50c80ba277" /> ### PoC 1. Log in to the DPanel dashboard to obtain the `Authorization` token. 2. Send a POST request to delete a file (e.g., `/tmp/1.txt` inside the container). **Request:** ```http POST /dpanel/api/common/attach/delete HTTP/1.1 Host: target-ip:8807 Authorization: Bearer <YOUR_TOKEN> Content-Type: application/x-www-form-urlencoded path=../../../../../../../../tmp/1.txt ``` <img width="1600" height="940" alt="image" src="https://github.com/user-attachments/assets/40e4d3cb-57f7-4a4e-adcc-a9503af762be" /> <img width="346" height="191" alt="image" src="https://github.com/user-attachments/assets/756c0891-e61b-434c-9386-6e701bbb1a97" /> <img width="1310" height="885" alt="image" src="https://github.com/user-attachments/assets/31c883c2-725e-4618-977c-35fe19adafb1" /> <img width="1009" height="209" alt="image" src="https://github.com/user-attachments/assets/2641fdfb-6d73-4940-bd92-44d748e0e6b7" /> <img width="1265" height="876" alt="image" src="https://github.com/user-attachments/assets/14c67ec8-ec37-4820-90be-a24f58819020" />

CVE-2025-66292 Affected Github.com/donknap/dpanel Versions

1 component(s)
Fixed Versions:
1.9.2
Product / Package Ecosystem Affected Versions Fixed Version
github.com/donknap/dpanel
golang/github.com/donknap/dpanel
Go
< 1.9.2
1.9.2

References

GitHub Advisory / Wiki ADVISORY
https://github.com/donknap/dpanel/security/advisories/GHSA-vh2x-fw87-4fxq
NVD — CVE-2025-66292 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-66292
Security Fix Commit FIX COMMIT
https://github.com/donknap/dpanel/commit/cbda0d90204e8212f2010774345c952e42069119
Github.com/donknap/dpanel Source Repository REPOSITORY
https://github.com/donknap/dpanel
Github.com/donknap/dpanel Release RELEASE
https://github.com/donknap/dpanel/releases/tag/v1.9.2

Frequently Asked Questions

What is CVE-2025-66292?
CVE-2025-66292 is a security vulnerability in Github.com/donknap/dpanel involving DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').
Which Github.com/donknap/dpanel versions are affected?
Affected versions include releases prior to 1.9.2 across affected packages: github.com/donknap/dpanel.
What version fixes CVE-2025-66292?
Upgrading to 1.9.2 (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/donknap/dpanel affected?
Yes, github.com/donknap/dpanel is affected in releases prior to 1.9.2. Upgrade your dependency to 1.9.2 or later.
What is the CVSS score of CVE-2025-66292?
CVE-2025-66292 has a CVSS v3.1 base score of 8.1 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
What CWE is associated with CVE-2025-66292?
CVE-2025-66292 is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.).
How can I check Go dependencies for CVE-2025-66292?
Run the dependency tree command: 'inspect dependencies for github.com/donknap/dpanel'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vh2x-fw87-4fxq",
  "modified" : "2026-01-15T20:17:37Z",
  "published" : "2026-01-15T17:58:42Z",
  "aliases" : [ "CVE-2025-66292" ],
  "summary" : "DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface",
  "details" : "### Summary\nDPanel has an arbitrary file deletion vulnerability in the `/api/common/attach/delete` interface. Authenticated users can delete arbitrary files on the server via path traversal.\n\n### Details\nWhen a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the `Delete` function within the `app/common/http/controller/attach.go` file.\n\nThe `path` parameter submitted by the user is directly passed to `storage.Local{}.GetSaveRealPath` and subsequently to `os.Remove` without proper sanitization or checking for path traversal characters (`../`).\n\nThe vulnerable code snippet:\n<img width=\"487\" height=\"363\" alt=\"image\" src=\"https://github.com/user-attachments/assets/b811de6f-1df1-49f3-af78-ea77bc420804\" />\n\n\nAnd the helper function in `common/service/storage/local.go` uses `filepath.Join`, which resolves `../` but does not enforce a chroot/jail:\n<img width=\"564\" height=\"66\" alt=\"image\" src=\"https://github.com/user-attachments/assets/84d5a4f7-9054-4e1d-aa6b-6b50c80ba277\" />\n\n### PoC\n1. Log in to the DPanel dashboard to obtain the `Authorization` token.\n2. Send a POST request to delete a file (e.g., `/tmp/1.txt` inside the container).\n\n**Request:**\n```http\nPOST /dpanel/api/common/attach/delete HTTP/1.1\nHost: target-ip:8807\nAuthorization: Bearer <YOUR_TOKEN>\nContent-Type: application/x-www-form-urlencoded\n\npath=../../../../../../../../tmp/1.txt\n```\n\n<img width=\"1600\" height=\"940\" alt=\"image\" src=\"https://github.com/user-attachments/assets/40e4d3cb-57f7-4a4e-adcc-a9503af762be\" />\n<img width=\"346\" height=\"191\" alt=\"image\" src=\"https://github.com/user-attachments/assets/756c0891-e61b-434c-9386-6e701bbb1a97\" />\n<img width=\"1310\" height=\"885\" alt=\"image\" src=\"https://github.com/user-attachments/assets/31c883c2-725e-4618-977c-35fe19adafb1\" />\n<img width=\"1009\" height=\"209\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2641fdfb-6d73-4940-bd92-44d748e0e6b7\" />\n<img width=\"1265\" height=\"876\" alt=\"image\" src=\"https://github.com/user-attachments/assets/14c67ec8-ec37-4820-90be-a24f58819020\" />",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/donknap/dpanel"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.9.2"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/donknap/dpanel/security/advisories/GHSA-vh2x-fw87-4fxq"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-66292"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/donknap/dpanel/commit/cbda0d90204e8212f2010774345c952e42069119"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/donknap/dpanel"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/donknap/dpanel/releases/tag/v1.9.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-15T17:58:42Z",
    "nvd_published_at" : "2026-01-15T17:16:04Z"
  }
}