Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Dpanel has an arbitrary file read vulnerability
Vulnerability Description
dpanel is an open source server management panel written in Go. In versions 1.2.0 through 1.7.2, dpanel allows authenticated users to read arbitrary files from the server via the /api/app/compose/get-from-uri API endpoint. The vulnerability exists in the GetFromUri function in app/application/http/controller/compose.go, where the uri parameter is passed directly to os.ReadFile without proper validation or access control. A logged-in attacker can exploit this flaw to read sensitive files from the host system, leading to information disclosure. No patched version is available as of this writing.
CVSS Information
N/A
Vulnerability Type
文件名或路径的外部可控制
Vulnerability Title
Dpanel 安全漏洞
Vulnerability Description
Dpanel是Donknap开源的一款轻量化的 Docker 可视化管理面板，提供完善的容器管理功能。 Dpanel 1.2.0至1.7.2版本存在安全漏洞，该漏洞源于/api/app/compose/get-from-uri API端点未正确验证uri参数，可能导致读取任意文件。
CVSS Information
N/A
Vulnerability Type
N/A