CVE-2025-66292: Arbitrary File Access in DPanel

The arbitrary file deletion vulnerability in DPanel poses a significant risk to system integrity and data confidentiality. An attacker exploiting this flaw can delete critical system files, configuration files, or user data, effectively disrupting service or causing irreversible data loss. The blast radius extends to any files accessible by the vulnerable interface, potentially including those within the web root or other sensitive directories. Successful exploitation could also facilitate privilege escalation if the attacker can delete files required for authentication or authorization, allowing them to gain unauthorized access to the system.

1. Reserved2025-11-26
2. Published2026-01-23
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-66292 is to upgrade DPanel to version 1.9.2 or later, which includes the necessary fix. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting access to the /api/common/attach/delete endpoint using a web application firewall (WAF) or proxy server. Configure the WAF to block requests originating from untrusted sources or those lacking proper authentication. Additionally, review file permissions and ownership to minimize the potential impact of a successful attack. After upgrading, verify the fix by attempting to access the /api/common/attach/delete endpoint with invalid parameters and confirming that file deletion is prevented.