CVE-2025-53534 Information

Aug 06, 2025 cve

Description

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5 when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths brute-force cracking etc.) they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs but but the middleware does not process r.URL.Path which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.

Reference

https://github.com/tnborg/panel/commit/ed5c74c7534230ba685273504af4c1e1e3598ff1 https://github.com/tnborg/panel/releases/tag/v2.5.6 https://github.com/tnborg/panel/security/advisories/GHSA-fm3m-jrgm-5ppg

CNNVD-202508-396 (Published: 2025-08-05)

Share on: