CVE-2026-79304 describes a path traversal vulnerability in CyberPanel 1.9.1. The flaw exists in the readFileContents method accessed via the /filemanager/controller endpoint. An authenticated attacker with domain ownership privileges can provide an arbitrary absolute or out-of-scope path in the fileName JSON property. The authorization mechanism only validates the domainName but does not canonicalize or restrict the fileName to the domain's home directory, resulting in disclosure of any file readable by the CyberPanel execution identity.

An attacker with authenticated access and ownership of any configured domain can read arbitrary files on the server that are accessible by the CyberPanel process. This can lead to unauthorized disclosure of sensitive information. There is no indication of integrity or availability impact. The CVSS 3.1 base score is 6.5 (medium severity), reflecting the confidentiality impact with low attack complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the CyberPanel interface to trusted users only and monitor for suspicious activity. Avoid granting domain ownership privileges to untrusted users. Consider implementing additional file access restrictions or web application firewall rules to detect and block path traversal attempts.