CVE-2026-25069
SunFounder Pironman Dashboard <= 1.3.13 Path Traversal Arbitrary File Read/Deletion
Reported by vulncheck · Published January 31, 2026
SunFounder Pironman Dashboard (pm_dashboard) version 1.3.13 and prior contain a path traversal vulnerability in the log file API endpoints. An unauthenticated remote attacker can supply traversal sequences via the filename parameter to read and delete arbitrary files. Successful exploitation can disclose sensitive information and delete critical system files, resulting in data loss and potential system compromise or denial of service.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| Pironman Dashboard (pm_dashboard) | SunFounder | 1.3.13 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| SunFounder | Pironman Dashboard (pm_dashboard) | 0 |
| SunFounder | Pironman Dashboard (pm_dashboard) | 0 |
Timeline
- Jan 31, 2026 CVE Published
- Feb 1, 2026 EPSS Score (30 in total, the first dated here)
- Feb 1, 2026 PoC Published (2 in total, the first dated here)
- Mar 22, 2026 Coalition ESS Score (2 in total, the first dated here)
- Mar 30, 2026 Security Advisory
- Jul 14, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-25069
vulnetix vdb fixes CVE-2026-25069Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-25069/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart