An authenticated path traversal vulnerability in CyberPanel 1.9.1 allows attackers with domain ownership to read sensitive system files, posing a significant risk to data confidentiality.

The application fails to properly canonicalize or restrict file paths within the fileName JSON property at the /filemanager/controller endpoint. This allows an authenticated user to bypass domain-level directory restrictions and access arbitrary files on the underlying filesystem.

The ability to read arbitrary files can lead to the exposure of sensitive configuration files, environment variables, and credentials stored on the server. Given the CVSS score of 6.5, this vulnerability represents a significant risk to the integrity of the hosting environment and could facilitate deeper system compromise. Successful exploitation results in unauthorized access to sensitive data that should otherwise be isolated from the attacker.

Immediate Action: Monitor official CyberPanel security advisories for the release of a patched version and apply updates as soon as they become available.

Proactive Monitoring: Review web server and application access logs for suspicious requests to the /filemanager/controller endpoint, specifically looking for path traversal patterns like dot-dot-slash sequences.

Compensating Controls: Implement strict Web Application Firewall (WAF) rules to inspect and block JSON payloads containing directory traversal characters or unexpected absolute paths directed at the file manager endpoint.

Public Exploit Available: Yes, a technical write-up containing attack details is available via the referenced TraceLoom research documentation.

While the CVSS score classifies this as a medium severity issue, the ability for an authenticated user to read arbitrary files constitutes a high risk for multi-tenant hosting environments. Administrators should restrict access to the file manager interface to trusted users only and prioritize applying the vendor patch once released. Failure to address this could lead to the exposure of critical credentials and system-wide secrets.