CVE-2024-2563

Summary

CVE-2024-2563 is a critical vulnerability affecting PandaXGO PandaX versions up to 20240310. This issue lies in the function DeleteImage of the file /apps/system/router/upload.go. An attacker can exploit this path traversal vulnerability by manipulating the argument fileName with the input ../../../../../../../../../tmp/1.txt, leading to a traversal to '../filedir'. The exploit can be initiated remotely, and the vulnerability details have been made public, increasing the risk of exploitation. VDB-257062 is the identifier assigned to this security issue.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.