CVE-2025-53363: dpanel Information Disclosure Vulnerability

CVE-2025-53363 Overview

CVE-2025-53363 is a path traversal vulnerability [CWE-22] in dpanel, an open source server management panel written in Go. The flaw affects versions 1.2.0 through 1.7.2 and allows authenticated users to read arbitrary files from the underlying host. The vulnerable code path exists in the /api/app/compose/get-from-uri API endpoint, which passes the uri parameter directly to os.ReadFile without validation or access control. Exploitation results in information disclosure of any file readable by the dpanel process. No patched release is available at the time of publication.

Critical Impact
Authenticated attackers can read arbitrary files from the dpanel host, exposing credentials, configuration files, and other sensitive data.

Affected Products

dpanel versions 1.2.0 through 1.7.2
Deployments exposing the dpanel management API to authenticated users
Systems where dpanel runs with elevated file system privileges

Discovery Timeline

2025-08-22 - CVE-2025-53363 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53363

Vulnerability Analysis

The vulnerability resides in the GetFromUri function located in app/application/http/controller/compose.go. The function accepts a user-supplied uri parameter through the /api/app/compose/get-from-uri endpoint and forwards it directly to Go's os.ReadFile call. Because the handler applies no path normalization, allow-listing, or containment check, the resulting file read operates against whatever absolute or relative path the caller provides.

An authenticated attacker can request files outside the intended compose configuration directory by supplying paths such as /etc/passwd, /etc/shadow, private SSH keys, Docker socket configurations, or application secrets. The response returns the raw file contents to the caller.

Root Cause

The root cause is missing input validation on a file path parameter combined with absent access control on the endpoint. The handler trusts the uri input as if it referenced only benign compose files, but the underlying Go standard library performs no restriction on the target path.

Attack Vector

Exploitation requires an authenticated session with the dpanel API. The attacker sends an HTTP request to /api/app/compose/get-from-uri with the uri parameter pointing at an arbitrary file on the host. Because dpanel typically runs with permissions sufficient to manage Docker and system services, the readable file set often includes highly sensitive material.

// Vulnerability description (no verified exploit code available)
// Endpoint: /api/app/compose/get-from-uri
// Vulnerable sink: os.ReadFile(uri) in GetFromUri (app/application/http/controller/compose.go)
// Precondition: authenticated dpanel session
// Result: contents of the requested file returned to the caller

Detection Methods for CVE-2025-53363

Indicators of Compromise

Requests to /api/app/compose/get-from-uri containing uri values with path traversal sequences such as ../ or absolute paths outside the compose working directory.
API access logs showing reads of sensitive host paths including /etc/passwd, /etc/shadow, ~/.ssh/, or Docker credential files.
Repeated get-from-uri calls from a single authenticated session enumerating multiple file paths.

Detection Strategies

Inspect dpanel HTTP access logs for the get-from-uri endpoint and alert on uri values that reference paths outside the expected compose directory.
Deploy web application firewall rules that block traversal patterns and absolute paths in the uri query parameter.
Correlate authenticated dpanel sessions with unexpected file read volume or access to system directories.

Monitoring Recommendations

Enable verbose request logging on the dpanel API, including full URL parameters and authenticated user identity.
Forward dpanel and host audit logs to a centralized analytics platform such as the Singularity Data Lake for retention and correlation.
Monitor host-level file access telemetry for reads of sensitive files by the dpanel process user.

How to Mitigate CVE-2025-53363

Immediate Actions Required

Restrict network access to the dpanel management interface to trusted administrators only, using firewall rules or a reverse proxy with allow-listing.
Review dpanel user accounts and revoke sessions for any accounts that are not strictly necessary.
Rotate credentials, SSH keys, and secrets that may have been readable on the dpanel host if exposure is suspected.

Patch Information

No patched version is available as of the last NVD update. Track the GitHub Security Advisory GHSA-gcqf-pxgg-gw8q for a fixed release and apply it as soon as it is published.

Workarounds

Block requests to /api/app/compose/get-from-uri at a reverse proxy until an upstream fix is available.
Run the dpanel process under a dedicated low-privilege account with access limited to required compose directories.
Isolate the dpanel host from sensitive credential stores and mount only the specific directories the application requires.

bash

# Example nginx snippet to block the vulnerable endpoint at the proxy layer
location = /api/app/compose/get-from-uri {
    return 403;
}