CVE-2026-25069
SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion
- State
- Published
- Severity
- 9.3 Critical
- Published
- Jan 31, 2026
- Updated
- Jul 14, 2026
- Reserved
- Jan 28, 2026
Description
SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can disclose sensitive information and delete critical system files, resulting in data loss and potential system compromise or denial of service.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Pironman Dashboard (pm_dashboard)SunFounder |
|
References
- https://github.com/sunfounder/pm_dashboardproduct
- https://github.com/sunfounder/pm_dashboard/blob/main/pm_dashboard/pm_dashboard.py#L62issue-tracking
- https://github.com/sunfounder/pm_dashboard/blob/main/pm_dashboard/pm_dashboard.py#L440issue-tracking
- https://www.vulncheck.com/advisories/sunfounder-pironman-dashboard-path-traversal-arbitrary-file-read-deletionthird-party-advisory
- https://gist.github.com/chapochapo/5db8702ede862af5c59a28b5d5a0aba3technical-descriptionexploit
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.