CVE-2025-52562

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-52562
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52562.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-52562
Aliases
  • GHSA-43g3-qpwq-hfgg
Published
2025-06-23T20:48:17.456Z
Modified
2026-04-10T05:33:20.837514Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution
Details

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files on the server. This issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.

Database specific 
{
    "cwe_ids": [
        "CWE-22",
        "CWE-98"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52562.json"
}
References

Affected packages

Git / github.com/ConvoyPanel/panel

Affected ranges

Type
GIT
Repo
https://github.com/ConvoyPanel/panel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
42c257d09d7a978908f4f49335671c6f90199176
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.4.1"
        }
    ]
}
Type
GIT
Repo
https://github.com/convoypanel/panel
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f8d6202f3e4912b65dbd9f80ba625576944ab36c

Affected versions

v0.*
v0.1.0-beta
v1.*
v1.0.0-beta
v1.0.0-beta-rc.1
v1.0.0-beta-rc.2
v1.0.0-beta-rc.3
v1.1.0-beta
v2.*
v2.0.0-beta
v2.0.1-beta
v2.0.2-beta
v2.0.3-beta
v3.*
v3.0.0-beta
v3.1.0-beta
v3.1.1-beta
v3.1.2-beta
v3.2.0-beta
v3.3.0-beta
v3.4.0-beta
v3.5.0-beta
v3.5.1-beta
v3.6.0-beta
v3.6.1-beta
v3.6.2-beta
v3.7.0-beta
v3.7.1-beta
v3.7.2-beta
v3.7.3-beta
v3.7.4-beta
v3.7.5-beta
v3.8.0-beta
v3.8.1-beta
v3.9.0-beta
v3.9.0-rc.1
v3.9.0-rc.2
v3.9.0-rc.3
v3.9.0-rc.5
v3.9.0-rc.6
v3.9.0-rc.7
v3.9.0-rc.8
v3.9.0-rc.9
v4.*
v4.0.0-beta
v4.0.0-rc.1
v4.0.0-rc.2
v4.0.0-rc.3
v4.0.0-rc.4
v4.0.0-rc.5
v4.0.0-rc.6
v4.1.0-beta
v4.2.0-beta
v4.2.1-rc.1
v4.2.2-rc.1
v4.2.2-rc.2
v4.2.3
v4.2.4
v4.3.0-rc.1
v4.3.1
v4.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-52562.json"