Convey Panel Directory Traversal in LocaleController leading to Remote Code Execution
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-98.
Summary
Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with malicious locale and namespace parameters. This allows the attacker to include and execute arbitrary PHP files on the server. This issue has been patched in version 4.4.1. A temporary workaround involves implementing strict Web Application Firewall (WAF) rules to incoming requests targeting the vulnerable endpoints.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ConvoyPanel | panel | 3.9.0-rc.3 to before 4.4.1 | 4.4.1 | Patch available | CNA |
- panel VendorConvoyPanel Affected 3.9.0-rc.3 to before 4.4.1 Fixed in 4.4.1 Patch available CNA
Remediation
- Fix · CNA panel (ConvoyPanel) Fixed in 4.4.1
Timeline
- 2026-10-02 Threatist record created from CVE-2025-52562
References
More ConvoyPanel vulnerabilities
- TI-2026-26125 Convoy: JWT Signature Verification Bypass Allows Authentication as Arbitrary Users CVSS 3.1CRITICAL 9.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences