SunFounder Pironman Dashboard (pm_dashboard) exposes a path traversal weakness in its log file API endpoints. An unauthenticated attacker can supply traversal sequences in the filename parameter to read or delete any file on the host. This flaw enables confidentiality violations, data loss, and potential system compromise or denial of service if critical configuration or code files are removed.

The vulnerability affects SunFounder's Pironman Dashboard version 1.3.13 and all earlier releases. Systems running these versions are susceptible to arbitrary file read and deletion unless the API is disabled or filtered.

With a CVSS score of 9.3 the flaw is rated critical. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of current exploitation. Nonetheless, the impact is severe: an attacker needs only to send a crafted HTTP request to the log file API, which is unauthenticated and remote, to read sensitive data or erase system files. Monitoring for anomalous endpoints and applying the fix should be a top priority.