Deniz Mert

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions prior to 3.0.0 **Description** Authenticated administrators can read arbitrary files from the server filesystem by supplying unsanitized file paths to the 'cloudAPI ReadReport' endpoint. This occurs because the `reportFile` parameter in the JSON request body is passed directly to the `open()` function in `cloudManager.py` without validation or allowlisting. This allows access to any file readable by the root-privileged CyberPanel process, such as credential files, SSL and SSH private keys, and JWT secret files. **Recommendations** Update CyberPanel to version 3.0.0 or later. Avoid using the `reportFile` parameter in the 'cloudAPI ReadReport' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** CyberPanel versions prior to 3.0.0 **Description** The WebTerminal FastAPI SSH service contains a hard-coded JSON Web Token (JWT) secret. This allows unauthenticated remote attackers to forge valid authentication tokens by signing them with the hard-coded secret value. By specifying the `ssh user` variable as `root`, an attacker can authenticate to the terminal service via WebSocket on port 8888 without valid credentials to obtain an interactive root shell. **Recommendations** Update CyberPanel to version 3.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** LearnPress – WordPress LMS Plugin for WordPress versions up to and including 4.3.2.2 **Description** The LearnPress – WordPress LMS Plugin for WordPress is susceptible to unauthorized file deletion. This is caused by a discrepancy in parameter handling during the authorization check for the DELETE operation. The `/wp-json/lp/v1/material/{file id}` API endpoint utilizes `file id` from the URL path, while the permission callback validates `item id` from the request body. This allows authenticated attackers with teacher-level access to delete lesson material files uploaded by other teachers by sending a DELETE request with their own `item id` to bypass authorization while targeting another teacher's `file id`. **Recommendations** Versions prior to 4.3.2.2 should be updated.