Description

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-08-13T18:18:08.197Z",
  "pubdate": "2026-08-13T18:18:08.197Z",
  "executiveSummary": "CyberPanel before 3.0.0 suffers from a critical path traversal vulnerability within its cloudAPI ReadReport endpoint, allowing authenticated administrators to read arbitrary files from the underlying server filesystem. The flaw stems from the insecure handling of the reportFile parameter within JSON request bodies, which is passed directly to the open() function in cloudManager.py without proper sanitization, validation, or allowlisting.\nBecause the CyberPanel process executes with root privileges, successful exploitation grants attackers the capability to traverse the filesystem and access highly sensitive system files, including credential files, SSL and SSH private keys, and JSON Web Token (JWT) secret files. This severe risk implication compromises the confidentiality and overall security posture of the host system.\nExploitation of this vulnerability requires administrative authentication to the CyberPanel interface, making it an elevation of privilege or malicious insider threat vector depending on the access level of the compromised account. No complex interaction is required beyond issuing a crafted HTTP request containing directory traversal sequences to the vulnerable API endpoint.",
  "technicalDetails": "The vulnerability resides in the cloudManager.py component of CyberPanel, specifically within the cloudAPI ReadReport endpoint. The root cause is improper input validation where user-supplied data originating from the reportFile parameter in a JSON request body is concatenated or passed directly into the Python open() function without undergoing strict path sanitization or restriction to an intended base directory.\nAffected versions include all CyberPanel deployments prior to version 3.0.0. The vulnerability is accessible over the network via the application's administrative interface. Although authentication is required to interact with the cloudAPI ReadReport endpoint, the privilege level required is that of an authenticated administrator.\nThe attack flow proceeds as follows: First, an authenticated attacker crafts a malicious HTTP request targeting the cloudAPI ReadReport endpoint. Within the JSON request body, the attacker manipulates the reportFile parameter to include directory traversal sequences such as dot-dot-slash (../) patterns pointing to target system files, such as /etc/passwd, SSH private keys, SSL certificates, or JWT secret keys.\nSecond, the request is processed by the CyberPanel backend application. The vulnerable cloudManager.py script takes the unsanitized string from the reportFile parameter and passes it directly to the file opening mechanism (open()). Because the CyberPanel service executes with root privileges, the operating system honors the file read request regardless of standard user-level file permissions, provided the file exists on the filesystem.\nFinally, the contents of the targeted arbitrary file are read by the application and returned in the HTTP response to the attacker. Post-exploitation impact includes the complete compromise of cryptographic secrets, administrative credentials, and session tokens, facilitating further lateral movement, persistent access, or complete system takeover."
}