CVE-2026-25069 is a path traversal vulnerability (CWE-22) affecting SunFounder Pironman Dashboard (pm_dashboard) versions 1.3.13 and prior. The vulnerability exists in the log file API endpoints where the filename parameter is not properly sanitized, allowing an unauthenticated attacker to supply directory traversal sequences. This enables reading and deletion of arbitrary files on the system. The CVSS 4.0 score is 9.3 (critical), reflecting the vulnerability's ease of exploitation and high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and no known exploits in the wild have been reported.

Successful exploitation allows unauthenticated remote attackers to read sensitive files and delete critical system files on affected installations. This can result in data loss, information disclosure, denial of service, and potential full system compromise due to the ability to manipulate arbitrary files.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable API endpoints and monitor for suspicious activity. Consider implementing network-level controls to limit exposure. Avoid exposing the log file API to untrusted networks.