DPanel hat eine beliebige Datei-Löschungs-Schwachstelle in der /api/common/attach/delete Schnittstelle in github.com/donknap/dpanel

The arbitrary file deletion vulnerability in DPanel poses a significant risk to system integrity and data confidentiality. An attacker exploiting this flaw could delete critical system files, configuration files, or user data, leading to denial of service or complete system failure. The ability to delete arbitrary files also allows for potential privilege escalation, as an attacker could remove files necessary for access control or authentication. The blast radius extends to any data stored on the server accessible through the vulnerable interface. While no specific real-world exploitation has been publicly reported, the ease of exploitation makes it a high-priority concern.

Organizations running DPanel, particularly those hosting websites or applications with sensitive data, are at risk. Shared hosting environments utilizing DPanel are especially vulnerable, as a compromise of one user's account could potentially impact other users on the same server. Legacy DPanel installations with outdated configurations are also at increased risk.

• go / server: Inspect DPanel logs for suspicious requests to /api/common/attach/delete with unusual parameters. Monitor file system integrity for unexpected deletions.

journalctl -u dpanel | grep '/api/common/attach/delete'

• generic web: Monitor access logs for requests to /api/common/attach/delete originating from unusual IP addresses or user agents.

grep '/api/common/attach/delete' /var/log/apache2/access.log

1. 2026-01-23Disclosure

   disclosure

1. Reserviert2025-11-26
2. Veröffentlicht2026-01-23
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-66292 is to immediately upgrade DPanel to version 1.9.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /api/common/attach/delete endpoint using a web application firewall (WAF) or reverse proxy, enforcing strict input validation and access controls. Monitor system logs for suspicious file deletion activity, particularly targeting sensitive directories. Implement file integrity monitoring (FIM) to detect unauthorized modifications. After upgrading, verify the fix by attempting to access the /api/common/attach/delete endpoint with invalid or malicious parameters and confirming that file deletion is prevented.