CVE Intelligence
Analysis AI-assisted

CVE-2026-25069: SunFounder Pironman Dashboard path traversal in log API

SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal flaw in log file API endpoints that lets unauthenticated remote attackers read and delete arbitrary files. VulnCheck scores it 9.3 under CVSS 4.0. The CISA KEV catalog does not list it in this record, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The SunFounder Pironman Dashboard (pm_dashboard) is reported to contain a path traversal weakness (CWE-22) in its log file API endpoints. According to the record, the filename parameter is not restricted enough to keep requests inside the intended directory.

Impact

  • Confidentiality: the record states that arbitrary files can be read, which may disclose sensitive information.
  • Integrity and availability: the record states that arbitrary files can be deleted, which may cause data loss, system compromise or denial of service.
  • The CVSS 4.0 vector in the record assigns high impact to confidentiality, integrity and availability and requires no authentication or user interaction.

Affected products and versions

  • The record describes version 1.3.13 and prior versions as affected.
  • The record contains no structured affected or fixed version data, so exact ranges should be confirmed with the vendor repository and the VulnCheck advisory.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Inventory all installations of pm_dashboard and confirm their running version.
  • Do not expose the dashboard to untrusted networks or the internet.
  • Check the vendor repository for a fixed release and apply it. The record does not name one.
  • Until a fix is applied, restrict access to the dashboard with network controls or an authenticated reverse proxy. This is a general measure and is not a verified fix.

Detection guidance

  • Review web and application logs for requests to log-related endpoints that contain unusual path characters or unexpected file names.
  • Monitor hosts running the dashboard for unexpected deletion or modification of log files and system files.
  • Alert on unauthenticated access to administrative or monitoring interfaces.

Limitations of the available information

  • The record gives no fixed version, no vendor statement and no affected version list beyond the description.
  • No EPSS score or SSVC data is available.
  • This analysis describes the weakness only at a high level and does not include technical exploitation details.

Frequently asked questions

What is CVE-2026-25069?

It is a path traversal weakness (CWE-22) in the log file API endpoints of SunFounder Pironman Dashboard (pm_dashboard), version 1.3.13 and prior, according to the record.

Is this vulnerability being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

What should administrators do now?

Confirm whether pm_dashboard is installed, keep it off untrusted networks, check the vendor repository for a fixed release, and restrict access until a fix is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.