GHSA-vh2x-fw87-4fxq

Source

https://github.com/advisories/GHSA-vh2x-fw87-4fxq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-vh2x-fw87-4fxq/GHSA-vh2x-fw87-4fxq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-vh2x-fw87-4fxq

Aliases

Published

2026-01-15T17:58:42Z

Modified

2026-02-03T02:56:24Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator

Summary

DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

Details

Summary

DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal.

Details

When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file.

The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../).

The vulnerable code snippet:

And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail:

PoC

Log in to the DPanel dashboard to obtain the Authorization token.
Send a POST request to delete a file (e.g., /tmp/1.txt inside the container).

Request:

POST /dpanel/api/common/attach/delete HTTP/1.1
Host: target-ip:8807
Authorization: Bearer <YOUR_TOKEN>
Content-Type: application/x-www-form-urlencoded

path=../../../../../../../../tmp/1.txt

Database specific

{
    "cwe_ids": [
        "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-01-15T17:58:42Z",
    "nvd_published_at": "2026-01-15T17:16:04Z",
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/donknap/dpanel

Package

Name: github.com/donknap/dpanel; View open source insights on deps.dev
Purl: pkg:golang/github.com/donknap/dpanel

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.9.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/01/GHSA-vh2x-fw87-4fxq/GHSA-vh2x-fw87-4fxq.json"