GHSA-vh2x-fw87-4fxq DPanel has an arbitrary file deletion vulnerability in /api/common/attach/delete interface

• Go github.com/donknap/dpanel: < 1.9.2 → fixed in 1.9.2

Summary DPanel has an arbitrary file deletion vulnerability in the `/api/common/attach/delete` interface. Authenticated users can delete arbitrary files on the server via path traversal. Details When a user logs into the administrative backend, this interface can be used to delete files. The vulnerability lies in the `Delete` function within the `app/common/http/controller/attach.go` file. The `path` parameter submitted by the user is directly passed to `storage.Local{}.GetSaveRealPath` and subsequently to `os.Remove` without proper sanitization or checking for path traversal characters (`../`). The vulnerable code snippet: And the helper function in `common/service/storage/local.go` uses `filepath.Join`, which resolves `../` but does not enforce a chroot/jail: PoC 1. Log in to the DPanel dashboard to obtain the `Authorization` token. 2. Send a POST request to delete a file (e.g., `/tmp/1.txt` inside the container). Request: ```http POST /dpanel/api/common/attach/delete HTTP/1.1 Host: target-ip:8807 Authorization: Bearer Content-Type: application/x-www-form-urlencoded path=../../../../../../../../tmp/1.txt ```