CVE-2025-53534

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53534
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53534.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53534
Aliases
Published
2025-08-05T20:58:56.350Z
Modified
2026-03-14T12:45:34.621896Z
Severity
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
RatPanel can perform remote command execution without authorization
Details

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.

Database specific 
{
    "cwe_ids": [
        "CWE-305"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53534.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/acepanel/panel

Affected ranges

Type
GIT
Repo
https://github.com/acepanel/panel
Events
Introduced
da44f1a8fe9763b0a76e906f63b3e48fddd2cb5c
Last affected
4f39f622085ee9e1eda5f7c262b84313a97b3ad1
Fixed
ed5c74c7534230ba685273504af4c1e1e3598ff1
Fixed
c4b84632b4b68e7fcca93c782c3cf370c30764bd
Database specific 
{
    "versions": [
        {
            "introduced": "2.3.19"
        },
        {
            "last_affected": "2.5.5"
        }
    ]
}

Affected versions

v2.*
v2.3.19
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.4.0
v2.4.1
v2.4.10
v2.4.11
v2.4.12
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.4.9
v2.5.0
v2.5.1
v2.5.2
v2.5.2-beta
v2.5.3-beta
v2.5.4-beta
v2.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53534.json"

Git / github.com/tnborg/panel

Affected ranges

Type
GIT
Repo
https://github.com/tnborg/panel
Events
Introduced
da44f1a8fe9763b0a76e906f63b3e48fddd2cb5c
Fixed
c4b84632b4b68e7fcca93c782c3cf370c30764bd
Database specific 
{
    "versions": [
        {
            "introduced": "2.3.19"
        },
        {
            "fixed": "2.5.6"
        }
    ]
}

Affected versions

v2.*
v2.3.19
v2.3.20
v2.3.21
v2.3.22
v2.3.23
v2.4.0
v2.4.1
v2.4.10
v2.4.11
v2.4.12
v2.4.2
v2.4.3
v2.4.4
v2.4.5
v2.4.6
v2.4.7
v2.4.8
v2.4.9
v2.5.0
v2.5.1
v2.5.2
v2.5.2-beta
v2.5.3-beta
v2.5.4-beta
v2.5.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53534.json"