What is the CVSS score of CVE-2025-66292?

CVE-2025-66292 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Golang are affected by CVE-2025-66292?

Organizations using Go. face notable risk from CVE-2025-66292, a path traversal vulnerability rated CVSS 8.1.. A patch is available.

Is there a public PoC exploit available for CVE-2025-66292?

Yes, a public proof-of-concept exploit is available for CVE-2025-66292. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-66292?

Within 7 days: Identify all affected systems running Go. and apply vendor patches promptly. Review file handling controls and restrict upload directories.

Golang CVE-2025-66292

HIGH

Path Traversal (CWE-22)

2026-01-15 security-advisories@github.com

GHSA-vh2x-fw87-4fxq

Path Traversal Golang Dpanel Suse

8.1

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Mar 12, 2026 - 18:07 vuln.today

Public exploit code

Patch released

Mar 12, 2026 - 18:07 nvd

Patch available

CVE Published

Jan 15, 2026 - 17:16 nvd

HIGH 8.1

DescriptionNVD

DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.

AnalysisAI

DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. [CVSS 8.1 HIGH]

Technical ContextAI

Classified as CWE-22 (Path Traversal). Affects the Delete component of Dpanel. DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is direc

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 1.9.2.. Validate and sanitize file path inputs. Use allowlists. Restrict network access to the affected service where possible.

More from same product – last 7 days

CVE-2026-9256 HIGH This Week

8.1 May 22

Heap buffer overflow in NGINX Plus and NGINX Open Source ngx_http_rewrite_module allows unauthenticated remote attackers

Vendor StatusVendor

CVE-2025-66292 vulnerability details – vuln.today

Back