CVE-2026-25069

N/A Unknown
Path Traversal

📋 TL;DR

SunFounder Pironman Dashboard versions 1.3.13 and earlier contain an unauthenticated path traversal vulnerability in log file API endpoints. Attackers can use directory traversal sequences in filename parameters to read or delete arbitrary files on the system. This affects all deployments using vulnerable versions of the pm_dashboard software.

💻 Affected Systems

Products:
  • SunFounder Pironman Dashboard (pm_dashboard)
Versions: 1.3.13 and prior
Operating Systems: Linux-based systems where deployed
Default Config Vulnerable: ⚠️ Yes
Notes: All default installations are vulnerable as the API endpoints are exposed without authentication by default.

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system compromise through reading sensitive files like /etc/shadow or SSH keys, followed by deletion of critical system files causing permanent data loss and system destruction.

🟠

Likely Case

Information disclosure of configuration files, logs, and credentials, with potential deletion of application files causing service disruption.

🟢

If Mitigated

Limited to reading non-sensitive application logs if proper file permissions and network segmentation are implemented.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Simple HTTP requests with path traversal sequences (../) in filename parameter can trigger the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Not available

Vendor Advisory: Not available

Restart Required: No

Instructions:

No official patch available. Consider workarounds or alternative software.

🔧 Temporary Workarounds

Network Access Restriction

linux

Restrict network access to the dashboard service using firewall rules

sudo ufw deny from any to any port 5000
sudo iptables -A INPUT -p tcp --dport 5000 -j DROP

Application Firewall/Reverse Proxy

linux

Deploy a reverse proxy with request filtering to block path traversal sequences

# Configure nginx/apache to filter requests containing ../ or similar patterns

🧯 If You Can't Patch

  • Implement strict network segmentation to isolate the dashboard from sensitive systems
  • Run the service with minimal privileges using a dedicated user account with restricted file access

🔍 How to Verify

Check if Vulnerable:

Test by sending HTTP GET request to /api/logs?filename=../../../etc/passwd and checking for file content in response

Check Version:

Check the version in pm_dashboard.py or package metadata

Verify Fix Applied:

Verify that path traversal attempts return error responses instead of file contents

📡 Detection & Monitoring

Log Indicators:

  • HTTP requests with ../ sequences in filename parameter
  • Access to files outside expected log directory

Network Indicators:

  • Unusual file read patterns from dashboard service
  • HTTP requests to log endpoints with traversal sequences

SIEM Query:

source="pm_dashboard" AND (url="*../*" OR filename="*../*")

📊 Metadata

CVE ID: CVE-2026-25069
CVSS v3 Score: N/A (Unknown)
CWE: CWE-22
Published: February 1, 2026
Last Updated: February 4, 2026

🤖 AI-assisted analysis, reviewed for accuracy

🔗 References

📤 Share This