CVE-2024-2563: PandaXGO PandaX upload.go DeleteImage path traversal
A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-2563?
CVE-2024-2563 is classified as a critical vulnerability.
How does CVE-2024-2563 affect PandaXGO PandaX?
CVE-2024-2563 affects the DeleteImage function in the file /apps/system/router/upload.go.
What is the potential impact of exploiting CVE-2024-2563?
Exploitation of CVE-2024-2563 could allow an attacker to manipulate file paths and gain access to unauthorized files.
What versions of PandaXGO PandaX are affected by CVE-2024-2563?
CVE-2024-2563 affects all versions of PandaXGO PandaX up to and including version 20240310.
How can I remediate CVE-2024-2563?
To remediate CVE-2024-2563, update PandaXGO PandaX to a version released after 20240310 that addresses this vulnerability.