A path traversal vulnerability in CyberPanel v1.9.1 allows authenticated remote attackers to access sensitive files on the host system.

The vulnerability exists within the compress method of the file manager controller, where improper path validation allows an authenticated user with domain ownership to supply out of scope file paths. The system fails to canonicalize these paths, resulting in the unauthorized archival and subsequent disclosure of arbitrary files readable by the web application user.

Successful exploitation of this vulnerability permits an attacker to exfiltrate sensitive configuration files, credentials, or application data from the server. Given the CVSS score of 6.5, this medium severity flaw poses a significant risk to data confidentiality, as it bypasses intended directory restrictions and facilitates unauthorized access to the underlying filesystem.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the file manager interface for untrusted users and monitor the /filemanager/controller endpoint for suspicious compress requests.

Proactive Monitoring: Review web access logs for requests to the /filemanager/controller endpoint, specifically looking for unusual patterns in the listOfFiles, basePath, or compressedFileName parameters.

Compensating Controls: Implement Web Application Firewall (WAF) rules to inspect and block requests containing directory traversal sequences, such as dot-dot-slash patterns, within the specified JSON properties.

Public Exploit Available: Yes, a published PoC exists, as documented in the technical write-up referenced in the CVE record.

Organizations utilizing CyberPanel v1.9.1 must prioritize securing the file manager component immediately. While waiting for an official vendor update, administrators should enforce strict access controls and monitor logs for signs of traversal attempts to prevent unauthorized file disclosure.