CVE-2025-66292

CVE-2025-66292 is an arbitrary file deletion vulnerability affecting DPanel, an open-source server management panel, in versions prior to 1.9.2. Authenticated users can exploit a path traversal flaw in the /api/common/attach/delete interface to delete arbitrary files on the server. The vulnerability stems from improper sanitization of user-supplied paths, allowing '..' characters to bypass checks and be passed directly to the os.Remove function. This vulnerability carries a CVSS score of 8.1 (HIGH), indicating a network-based attack with low privileges required and no user interaction, leading to high integrity and availability impacts. The lack of a chroot/jail enforcement allows for significant damage. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. However, the vulnerability has garnered significant community attention with 10 mentions, suggesting awareness among security researchers.