CVE-2026-79306 describes a path traversal vulnerability in CyberPanel v1.9.1's compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with attacker-controlled basePath and compressedFileName values in a method=compress request. The application validates only domain ownership but fails to canonicalize or restrict these paths to the authorized site directory. As a result, the backend appends these paths to zip or tar archive commands and executes them as the website externalApp user, enabling disclosure of arbitrary readable files through the generated archive.

An attacker with authenticated access and domain ownership privileges can read arbitrary files on the server by exploiting the path traversal flaw in the compress method. This leads to confidentiality breaches of sensitive data accessible to the externalApp user. There is no indication of integrity or availability impact. The CVSS v3.1 base score is 6.5 (medium severity), reflecting the ease of network exploitation with low privileges and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to trusted parties only and monitor for suspicious use of the compress method. Avoid exposing the /filemanager/controller endpoint to untrusted users. Do not rely solely on domain ownership validation for file path authorization.