CyberPanel 1.9.1 contains a path traversal flaw in the readFileContents method of the /filemanager/controller endpoint. An authenticated attacker who owns a domain configured in the panel can supply any absolute or out‑of‑scope file path in the fileName JSON property. Because the application only checks the supplied domainName and does not canonicalize or restrict fileName to that domain’s home directory, the request returns the contents of any file readable by the CyberPanel execution identity. This gives the attacker potential access to sensitive configuration files, credentials, or other secrets stored on the host, compromising confidentiality of the system.

The vulnerability is specific to CyberPanel version 1.9.1. No other product or version information is provided, and the affected vendor/product list is not specified in the CNA data.

The CVSS base score of 6.5 indicates a moderate severity threat. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalogue. Exploitation requires authentication and domain ownership; however, once these prerequisites are met, the attacker can read arbitrary files on the host. The lack of path canonicalization presents a clear opportunity for information disclosure, and the vulnerability’s impact depends on the sensitivity of the files accessible under the CyberPanel execution identity.