CVE-2026-67613 is a path traversal vulnerability affecting CyberPanel before version 3.0.0. The flaw exists in the cloudAPI ReadReport endpoint where the reportFile parameter is not sanitized or validated before being passed to the open() function in cloudManager.py. This allows authenticated administrators to read arbitrary files on the server filesystem, including highly sensitive files such as credential stores, private keys, and secret tokens. The vulnerability requires administrator privileges and does not involve user interaction. No official patch or remediation level has been documented in the provided data.

An attacker with authenticated administrator access can read any file accessible by the CyberPanel process, which runs with root privileges. This can lead to disclosure of sensitive information such as credentials, private keys for SSL and SSH, and JWT secrets. Such exposure could facilitate further compromise of the server or connected systems. The vulnerability does not allow privilege escalation or remote code execution directly but significantly undermines confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted personnel only and monitor for suspicious activity. Avoid exposing the cloudAPI ReadReport endpoint to untrusted networks. Consider implementing additional file access controls or input validation at the application or web server level as a temporary mitigation.