**Name of the Vulnerable Software and Affected Versions:**

RatPanel versions 2.3.19 through 2.5.5

**Description:**

RatPanel is susceptible to remote code execution (RCE) and unauthorized access. An attacker who obtains the backend login path of RatPanel can execute system commands or take over hosts managed by the panel without logging in. This is due to the `CleanPath` middleware not processing `r.URL.Path`, leading to path misinterpretation and authentication bypass. Specifically, the vulnerability affects the `must login` middleware, allowing access to dangerous interfaces such as `/api/ws/exec` and `/api/ws/ssh`. Exploitation requires activating a session, but does not require completing the full authentication process.

**Recommendations:**

RatPanel versions 2.3.19 through 2.5.5 are affected and should be updated to version 2.5.6 or later.