CVE-2026-79306

Name of the Vulnerable Software and Affected Versions CyberPanel version 1.9.1

Description A path traversal issue exists in the compress method exposed through the '/filemanager/controller' endpoint. An authenticated remote attacker who owns a configured domain can provide absolute or out-of-scope file paths via the listOfFiles JSON property, along with controlled basePath and compressedFileName values, during a method=compress request. The application fails to canonicalize or restrict these paths to the authorized site directory, appending them to zip or tar archive commands executed as the website externalApp user. This allows the disclosure of arbitrary readable files through the resulting archive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.