Vulnerability · Published Aug 22, 2025 · Assigned by GitHub_M

CVE-2025-53363Dpanel has an arbitrary file read vulnerability

Medium 4.8

In plain English

A medium-severity path traversal in dpanel from donknap. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 4.0)4.8Medium

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/donknap/dpanel	no fix listed	GO-2025-3909
Go	github.com/donknap/dpanel	no fix listed	GHSA-gcqf-pxgg-gw8q

Affected products (as reported)

Vendor	Product	Versions
donknap	dpanel	>= 1.2.0, <= 1.7.2

Weakness: CWE-73, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:P

References

https://github.com/donknap/dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q x_refsource_CONFIRM