Directory Traversal in Convey Panel in LocaleController leidend tot Remote Code Execution

The impact of CVE-2025-52562 is severe. Successful exploitation allows an unauthenticated attacker to execute arbitrary code on the Convoy Panel server. This could lead to complete system takeover, including data exfiltration, modification, or deletion. An attacker could potentially gain access to sensitive server configurations, KVM virtual machine details, and user credentials. Lateral movement within the network is also a significant concern, as the attacker could leverage the compromised Convoy Panel to target other systems. The blast radius extends to any data or systems accessible from the compromised server.

1. Gereserveerd2025-06-18
2. Gepubliceerd2025-06-23
3. Gewijzigd2025-06-24
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-52562 is to immediately upgrade Convoy Panel to version 4.4.1 or later. If upgrading is not immediately feasible, implement strict Web Application Firewall (WAF) rules to filter incoming requests, specifically targeting malicious locale and namespace parameters. These rules should block any requests containing suspicious characters or patterns that could indicate an attempt to exploit the directory traversal vulnerability. Consider implementing input validation and sanitization on the LocaleController component to prevent malicious input from being processed. After upgrading, confirm the fix by attempting to trigger the vulnerability with a crafted HTTP request and verifying that it is blocked.