CVE-2025-53363: Dpanel has an arbitrary file read vulnerability

August 22, 2025 (updated November 10, 2025)

Dpanel has an arbitrary file read vulnerability in the /api/app/compose/get-from-uri interface.Logged in to Dpanel ,this interface can be used to read arbitrary files.

References

github.com/advisories/GHSA-gcqf-pxgg-gw8q
github.com/donknap/dpanel
github.com/donknap/dpanel/security/advisories/GHSA-gcqf-pxgg-gw8q
nvd.nist.gov/vuln/detail/CVE-2025-53363
pkg.go.dev/vuln/GO-2025-3909

Code Behaviors & Features

Detect and mitigate CVE-2025-53363 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →