dpanel Information Disclosure Vulnerability via Arbitrary File Read

An information disclosure vulnerability has been identified in dpanel, an open-source server management panel written in Go. This issue affects versions 1.2.0 through 1.7.2. The vulnerability allows authenticated users to read arbitrary files from the server through the /api/app/compose/get-from-uri API endpoint. The problem arises in the GetFromUri function, where the uri parameter is directly passed to os.ReadFile without adequate validation or access control. As a result, a logged-in attacker could exploit this flaw to access sensitive files on the host system.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive files on the server, causing information disclosure.