CVE-2025-53363
published 2025-08-22CVE-2025-53363: dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from…
PriorityP429medium4.8CVSS 4.0
AVNACLATNPRHUINVCNVINVANSCHSINSANEPCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.43%
34.7th percentile
dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| donknap | dpanel | — | — |
| github.com | donknap_dpanel | 1.2.0 – 1.7.2 | — |
| github.com | donknap_dpanel | >= 1.2.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel
osv·2025-08-29
CVE-2025-53363 Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel
Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel
Dpanel has an arbitrary file read vulnerability in github.com/donknap/dpanel
GHSA
Dpanel has an arbitrary file read vulnerability
ghsa·2025-08-22
CVE-2025-53363 [MEDIUM] CWE-22 Dpanel has an arbitrary file read vulnerability
Dpanel has an arbitrary file read vulnerability
### Summary
Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.
### Details
When a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling.
### PoC
```text
POST /api/app/compose/get-from-uri HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
OSV
Dpanel has an arbitrary file read vulnerability
osv·2025-08-22
CVE-2025-53363 [MEDIUM] Dpanel has an arbitrary file read vulnerability
Dpanel has an arbitrary file read vulnerability
### Summary
Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.
### Details
When a user logs into the administrative backend, this interface can read any files on the host/sever (given the necessary permissions), which may lead to system information leakage. The vulnerability lies in the GetFromUri function within the app/application/http/controller/compose.go file. The uri parameter submitted by the user in JSON format can be directly read and returned by os.ReadFile without proper security handling.
### PoC
```text
POST /api/app/compose/get-from-uri HTTP/1.1
Host: x.x.x.x
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-08-22
Published