CVE-2025-53534 (CNNVD-202508-396)
中文标题:
RatPanel 安全漏洞
英文标题:
RatPanel can perform remote command execution without authorization
漏洞描述
中文描述:
RatPanel（耗子面板）是树新峰（TreeNewBee）开源的一个服务器运维管理面板。 RatPanel（耗子面板）2.3.19至2.5.5版本存在安全漏洞，该漏洞源于CleanPath中间件未处理r.URL.Path，可能导致远程代码执行和未经授权访问。
英文描述:
RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| tnb-labs | panel | >= 2.3.19, < 2.5.6 | - | - |
cpe:2.3:a:tnb-labs:panel:>=_2.3.19,_<_2.5.6:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
4.0 (cna)
HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-53534 |
2025-11-11 15:23:28 | 2025-11-11 07:40:41 |
| NVD | nvd_CVE-2025-53534 |
2025-11-11 15:00:58 | 2025-11-11 07:48:28 |
| CNNVD | cnnvd_CNNVD-202508-396 |
2025-11-11 15:12:52 | 2025-11-11 08:00:08 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-396
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- data_sources: ['cve'] -> ['cve', 'nvd']