CyberPanel CVE-2026-79304

Requires an authenticated CyberPanel account that owns at least one configured domain (PR:L); the attacker passes their own valid domainName to satisfy the authorization check, then supplies an arbitrary absolute or out-of-scope path in the fileName JSON property of the readFileContents call at /filemanager/controller. Exploitation is limited by the need for valid panel credentials and domain ownership, but needs no user interaction and works against default configurations of v1.9.1. Impact scope (which files are readable) is bounded only by the CyberPanel execution identity, which is typically root - so effectively all files on the host.

This is a moderate-priority, credible information-disclosure flaw rather than a critical mass-exploitation risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 6.5) is internally consistent: network-reachable, low-complexity, but requiring authentication (PR:L) and delivering confidentiality-only impact (C:H, I:N, A:N). The C:H is justified because CyberPanel typically runs as root, so a traversal read can expose highly sensitive files (/etc/shadow, TLS private keys, other tenants' data). No EPSS score, no CISA KEV listing, and no SSVC decision data were provided. No weaponized public exploit was identified - the references are the vulnerable source lines in the CyberPanel repo plus a third-party TraceLoom technical writeup (analysis, not confirmed exploit code). The gating factor is that the attacker must already hold a valid CyberPanel account owning at least one configured domain, which limits opportunistic exploitation but is realistic in shared-hosting/multi-tenant environments where the panel is exactly the boundary being broken. Note CyberPanel has a history of mass exploitation (2024 RCE / ransomware campaigns), so any authenticated hosting-panel weakness deserves prompt patching even at a 6.5 base score.

A low-privileged CyberPanel tenant who legitimately owns one domain sends a crafted JSON request to /filemanager/controller invoking readFileContents with an absolute or traversal path (e.g. /etc/shadow) in the fileName property while passing their own valid domainName. Because authorization only validates domainName and never restricts fileName to that domain's home directory, the server returns the target file's contents with the privileges of the CyberPanel process (root), enabling cross-tenant data theft and credential harvesting. No weaponized public exploit is confirmed, though a third-party technical writeup describing the flaw exists.