CVE-2025-66292 is a path traversal vulnerability classified under CWE-22 and CWE-73, found in donknap's DPanel server management software prior to version 1.9.2. The vulnerability exists in the /api/common/attach/delete API endpoint, where authenticated users can submit a path parameter that is insufficiently sanitized. Specifically, the Delete function in app/common/http/controller/attach.go passes this parameter directly to storage.Local{}.GetSaveRealPath and then to os.Remove for file deletion. Although filepath.Join is used internally to resolve relative paths, it does not enforce a chroot or jail environment, allowing traversal sequences like '../' to escape the intended directory boundaries. This flaw enables attackers with legitimate backend access to delete arbitrary files on the server, potentially including critical system files or application data, leading to denial of service or data integrity compromise. The vulnerability requires authentication but no user interaction beyond API calls. The CVSS v3.1 score is 8.1 (high), reflecting network attack vector, low attack complexity, privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impacts. The issue was publicly disclosed in January 2026 and fixed in DPanel version 1.9.2. No known exploits have been reported in the wild as of now.

For European organizations, this vulnerability poses a significant risk to server stability and data integrity, especially for those relying on DPanel for server management. Successful exploitation can lead to arbitrary deletion of files, potentially causing service outages, loss of critical configuration or operational data, and increased recovery costs. Organizations in sectors with high regulatory requirements for data integrity and availability, such as finance, healthcare, and critical infrastructure, could face compliance violations and reputational damage if exploited. Since the vulnerability requires authenticated access to the administrative backend, the risk is elevated if credential management is weak or if insider threats exist. The ability to delete arbitrary files can also facilitate further attacks by removing logs or security controls. Given the open-source nature of DPanel, organizations using customized or older versions may be unaware of the vulnerability, increasing exposure.

European organizations should immediately upgrade DPanel installations to version 1.9.2 or later, where the vulnerability is patched. Until patching is possible, restrict administrative backend access strictly via network segmentation, VPNs, or IP whitelisting to limit exposure. Implement strong authentication mechanisms, including multi-factor authentication, to reduce the risk of credential compromise. Conduct thorough audits of user permissions to ensure only trusted personnel have access to the vulnerable API endpoint. Monitor server logs for unusual file deletion activities and implement file integrity monitoring to detect unauthorized changes. Consider deploying web application firewalls (WAFs) with custom rules to detect and block path traversal patterns in API requests. Finally, educate administrators on the risks of path traversal and the importance of timely patching and secure configuration.