CVE-2026-67613: CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReport
CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CyberPanelto a version that resolves this vulnerability.Fixed in 3.0.0 - Compensating control
Restrict access to the cloudAPI ReadReport endpoint so only trusted, authenticated administrators can reach it.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67613?
CVE-2026-67613 has a medium severity rating of 4.9.
What does CVE-2026-67613 affect?
CVE-2026-67613 affects CyberPanel versions prior to 3.0.0.
How do I fix CVE-2026-67613?
To fix CVE-2026-67613, you should update CyberPanel to version 3.0.0 or later.
What type of vulnerability is CVE-2026-67613?
CVE-2026-67613 is a path traversal vulnerability that allows unauthorized file access.
Who is impacted by CVE-2026-67613?
Authenticated administrators using CyberPanel can be impacted by CVE-2026-67613 if they interact with the cloudAPI ReadReport endpoint.