CVE-2025-66292 DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface
Authenticated attackers can delete arbitrary files on the server via path traversal in the attachment deletion interface.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-66292?
CVE-2025-66292 is a high-severity path traversal vulnerability in donknap dpanel, published on 15 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DPanel is an open source server management panel written in Go. Prior to 1.9.2, DPanel has an arbitrary file deletion vulnerability in the /api/common/attach/delete interface. Authenticated users can delete arbitrary files on the server via path traversal. When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the Delete function within the app/common/http/controller/attach.go file. The path parameter submitted by the user is directly passed to storage.Local{}.GetSaveRealPath and subsequently to os.Remove without proper sanitization or checking for path traversal characters (../). And the helper function in common/service/storage/local.go uses filepath.Join, which resolves ../ but does not enforce a chroot/jail. This vulnerability is fixed in 1.9.2.
Which versions are affected by CVE-2025-66292?
3 open source packages ship an affected version, including github.com/donknap/dpanel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/donknap/dpanel Go | All versions | 1.9.2 |
github.com/donknap/dpanel Go | All versions | 1.9.2 |
github.com/donknap/dpanel Go | All versions | 1.9.2 |
Products include Dpanel Dpanel.
How do I fix CVE-2025-66292?
Upgrade github.com/donknap/dpanel to 1.9.2 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2025-66292 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66292 exists.
Sources
Also known as GHSA-vh2x-fw87-4fxq, GO-2026-4318.