PT-2025-26645 · Convoy · Convoy

Anushk-Fro · Publicado 2025-06-23 · Atualizado 2025-07-31 · CVE-2025-52562

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Convoy versions 3.9.0-rc3 through 4.4.0

Description: Convoy is a KVM server management panel for hosting businesses. A directory traversal vulnerability exists in the LocaleController component, allowing an unauthenticated remote attacker to exploit this issue by sending a specially crafted HTTP request with malicious locale and namespace parameters. This enables the attacker to include and execute arbitrary PHP files on the server. The issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.

Recommendations: For Convoy versions 3.9.0-rc3 through 4.4.0, update to version 4.4.1 to resolve the issue. As a temporary workaround, consider implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.

Exploit

Correção

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

CWE-98

Identificadores relacionados

CVE-2025-52562

GHSA-43G3-QPWQ-HFGG

Produtos afetados

Convoy

Referências · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52562.json · Exploit
• https://github.com/ConvoyPanel/panel/security/advisories/GHSA-43g3-qpwq-hfgg · Nota
• https://github.com/ConvoyPanel/panel/commit/f8d6202f3e4912b65dbd9f80ba625576944ab36c · Nota
• https://twitter.com/cybertzar/status/1937760337501302895 · Publicação no Twitter
• https://t.me/cvetracker/26877 · Publicação no Telegram
• https://twitter.com/PaxionCyber/status/1937511840076169503 · Publicação no Twitter
• https://t.me/latest_high_impact_cve/2789 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2025-52562 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1937252960360083739 · Publicação no Twitter
• https://twitter.com/taku888infinity/status/1937342905880051796 · Publicação no Twitter
• https://twitter.com/the_yellow_fall/status/1937333971639222374 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/1937257141967982723 · Publicação no Twitter
• https://twitter.com/CybrPulse/status/1937522774815203578 · Publicação no Twitter
• https://twitter.com/fridaysecurity/status/1937334267647816021 · Publicação no Twitter
• https://twitter.com/fofabot/status/1937722703919874457 · Publicação no Twitter