An authenticated path traversal vulnerability in DPanel allows remote attackers to delete arbitrary files on the server, posing a significant risk to system integrity.

The vulnerability exists in the /api/common/attach/delete interface, specifically within the Delete function of app/common/http/controller/attach.go. Authenticated administrative users can exploit this via path traversal characters (../) because the application fails to properly sanitize the path parameter before passing it to the file removal process.

Successful exploitation allows an authenticated user to delete critical system files, configuration files, or data, which can lead to total service disruption and loss of system availability. Given the CVSS score of 8.1, this vulnerability is classified as High severity because the ability to delete arbitrary files can be leveraged to compromise the operational stability of the entire server management environment.

Immediate Action: Update DPanel to version 1.9.2 or later immediately to incorporate the necessary path sanitization fixes.

Proactive Monitoring: Review administrative access logs for unusual patterns, specifically monitoring for requests to the /api/common/attach/delete endpoint containing path traversal sequences.

Compensating Controls: Implement strict role-based access control to limit administrative privileges and deploy a Web Application Firewall (WAF) to block requests containing directory traversal sequences directed at the application API.

Public Exploit Available: Unknown

This vulnerability presents a high risk to administrative infrastructure and must be addressed with urgency. Administrators should prioritize the update to version 1.9.2 to eliminate the underlying path traversal flaw and prevent unauthorized file deletion. Failure to patch leaves the server susceptible to destructive attacks that could render the entire management panel and underlying host inoperable.