CyberPanel 1.9.1 has a path traversal flaw in its compression routine accessed through the /filemanager/controller endpoint. The routine accepts a JSON payload containing a list of files, a basePath, and a compressedFileName, and it trusts only that the requesting user owns a domain on the server. Because the supplied paths are not canonicalized or restricted to the corresponding site directory, the backend concatenates them into zip or tar commands that run under the website's externalApp user. This allows an authenticated attacker who owns any configured domain to request an archive that includes arbitrary files located anywhere on the server, enabling disclosure of sensitive configuration or application data.

The vulnerability affects CyberPanel version 1.9.1, specifically its filemanager component’s compression endpoint. No other vendors or versions are listed in the CNA data.

A CVSS score of 6.5 indicates moderate risk, primarily due to the confidentiality impact. Exploitation requires authenticated access and ownership of a domain on the server, narrowing the attacker pool to legitimate site administrators. The EPSS score is not available, so the exact likelihood remains uncertain, and the vulnerability is not listed in the CISA KEV catalog. If exploited, an attacker can retrieve any readable file on the server through the generated archive, but no evidence indicates a denial of service or other availability impact. The attack vector is an authenticated remote request to a controlled endpoint.