CVE-2024-53537
Published: 31 January 2025
Summary
CVE-2024-53537 is a critical-severity Path Traversal (CWE-22) vulnerability in Openpanel Openpanel. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 9.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-53537 is a path traversal vulnerability (CWE-22) affecting the File Actions functionality in the File Manager component of OpenPanel versions 0.3.4 through 0.2.1. The flaw permits unauthorized access to files and directories outside the intended scope, as reflected in its CVSS 3.1 score of 9.1.
Unauthenticated attackers with network access can exploit the issue remotely with low attack complexity and no user interaction required. Successful exploitation grants high impact on confidentiality and integrity, enabling arbitrary file reads or modifications within the application's environment.
The referenced OpenPanel changelog for version 0.3.5 explicitly documents security fixes addressing this vulnerability, indicating that upgrading to 0.3.5 or later mitigates the exposure. The additional reference points to a public disclosure archive containing further technical details.
EPSS for the CVE reached a peak of 0.0784 after starting from a lower baseline, with the current value at 0.0581; this upward movement indicates emerging exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51988
Vulnerability details
An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Directory traversal in public-facing File Manager component directly enables remote unauthenticated exploitation for arbitrary file read/modify.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the insufficient input validation in OpenPanel File Manager's File Actions by enforcing validation to reject directory traversal paths like '../'.
Mandates timely remediation of the specific directory traversal flaw through patching to OpenPanel v0.3.5 or later.
Enforces access control policies to restrict file reads and modifications to only intended directories, mitigating successful traversal attempts.