EUVD-2025-18951

| CVE-2025-52562 CRITICAL
2025-06-23 [email protected]
10.0
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 15, 2026 - 22:10 vuln.today
EUVD ID Assigned
Mar 15, 2026 - 22:10 euvd
EUVD-2025-18951
CVE Published
Jun 23, 2025 - 21:15 nvd
CRITICAL 10.0

Tags

PHP Path Traversal

Description

Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files on the server. This issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.

Analysis

A path traversal vulnerability in versions 3.9.0-rc3 to (CVSS 10.0) that allows the attacker. Critical severity with potential for significant impact on affected systems.

Technical Context

CWE-22 (Path Traversal). CVSS 10.0 indicates critical severity with likely remote exploitation vector. Affects versions 3.9.0-rc3 to.

Affected Products

['versions 3.9.0-rc3 to']

Remediation

Monitor vendor channels for patch availability.

Priority Score

52
Low Medium High Critical
KEV: 0
EPSS: +1.9
CVSS: +50
POC: 0

Share

EUVD-2025-18951 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy