What is the CVSS score of CVE-2025-52562?

CVE-2025-52562 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 1.9%.

Which versions of PHP are affected by CVE-2025-52562?

CVE-2025-52562 is a critical path traversal vulnerability affecting versions 3.9.0-rc3 and later, with a perfect CVSS score of 10.0, enabling unauthorized file system access that could compromise…. A patch is available.

How to fix or mitigate CVE-2025-52562?

Within 24 hours: Identify all systems running affected versions (3.9.0-rc3 and later) and assess network exposure; notify stakeholders of critical risk. Within 7 days: Apply available vendor patch to all production and non-production systems; validate patch deployment and restart services. Within 30 days: Conduct post-patch security validation, review access logs for exploitation attempts, and update change management records.

PHP CVE-2025-52562

EUVD-2025-18951 CRITICAL

Path Traversal (CWE-22)

2025-06-23 security-advisories@github.com

PHP Path Traversal

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 05:53 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.4.1

EUVD ID Assigned

Mar 15, 2026 - 22:10 euvd

EUVD-2025-18951

Analysis Generated

Mar 15, 2026 - 22:10 vuln.today

CVE Published

Jun 23, 2025 - 21:15 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files on the server. This issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.

AnalysisAI

A path traversal vulnerability in versions 3.9.0-rc3 to (CVSS 10.0) that allows the attacker. Critical severity with potential for significant impact on affected systems.