CVE-2025-52562

Deeper analysis

Convoy is a KVM server management panel for hosting providers, and versions 3.9.0-rc3 through 4.4.0 contain a directory traversal vulnerability in the LocaleController component. The flaw, tracked as CVE-2025-52562 and assigned CWE-22 and CWE-98, permits an unauthenticated remote attacker to supply crafted locale and namespace parameters in an HTTP request that results in the inclusion and execution of arbitrary PHP files on the server. The issue carries a CVSS 3.1 score of 10.0, reflecting network-accessible exploitation with no required credentials or user interaction and full confidentiality, integrity, and availability impact under a changed scope.

An attacker can send a single malicious request to the affected endpoints and achieve arbitrary code execution on the underlying server, potentially leading to full compromise of the management panel and any hosted virtual machines. Because the vulnerability is unauthenticated, exploitation can originate from any internet-reachable system without prior access or authentication.

The vulnerability was addressed in version 4.4.1, as noted in the project’s GitHub security advisory GHSA-43g3-qpwq-hfgg and the associated commit that hardened the LocaleController parameter handling. A temporary workaround recommended in the advisory is the deployment of strict Web Application Firewall rules that block or sanitize incoming requests targeting the vulnerable endpoints.

The EPSS score remains flat at 0.0378 with no material increase after disclosure.