CVE-2026-79304

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1

Description An authenticated remote attacker with ownership of any configured domain can access files outside the intended directory. This occurs because the application validates the domainName but fails to canonicalize or restrict the fileName JSON property to the domain's home directory. By providing an arbitrary absolute or out-of-scope path in the fileName property, an attacker can retrieve the contents of files readable by the CyberPanel execution identity via the readFileContents() function in the '/filemanager/controller' endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.