CVE-2026-25069
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A path traversal vulnerability in SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior allows an unauthenticated remote attacker to read and delete arbitrary files by supplying traversal sequences via the filename parameter in log file API endpoints. This can lead to disclosure of sensitive information and deletion of critical system files.
Risk Assessment
The risk includes exposure of sensitive data, data loss, and potential system compromise or denial of service (DoS) due to deletion of critical files.
Recommendation
Immediately update SunFounder Pironman Dashboard to a version later than 1.3.13 that fixes the path traversal vulnerability. Until then, restrict access to the log API endpoints to trusted networks only.
Original NVD description (English source)
SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can disclose sensitive information and delete critical system files, resulting in data loss and potential system compromise or denial of service.