CyberPanel versions prior to 3.0.0 contain a path traversal flaw that allows administrators to read any file accessible to the root‑privileged CyberPanel process. By supplying an unsanitized reportFile parameter in the cloudAPI ReadReport request, an attacker can traverse directories and retrieve credential files, SSL private keys, SSH private keys, and JWT secrets. The flaw arises because the file path is passed directly to open() without sanitization or allowlisting, enabling arbitrary file read.

The vulnerability affects the CyberPanel product from usmannasir, affecting all releases before 3.0.0. Administrators who have access to the cloudAPI ReadReport endpoint are potentially impacted.

The CVSS score of 6.9 indicates a moderate severity vulnerability. The EPSS score is not available, but the exploit requires authenticated administrator access, which limits the attack surface to privileged users with network access to the server. The vulnerability is not listed in the CISA KEV catalog, suggesting no widely documented exploitation. Nevertheless, an attacker who can become an authenticated administrator could exploit this flaw to read sensitive files.