CVE-2025-15241
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
A security vulnerability was detected in CloudPanel Community Edition up to version 2.5.1. It affects an unknown function in the /admin/users file of the HTTP Header Handler component. Manipulation of the Referer argument leads to an open redirect. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.5.2 fixes the issue.
Risk Assessment
The risk is the possibility of redirecting users to malicious sites, which could be used for phishing. A quick upgrade is recommended.
Recommendation
It is recommended to immediately upgrade CloudPanel to version 2.5.2 or later. Also inform administrators about the open redirect risk.
Other vulnerabilities in CloudPanel
See all- CVE-2023-35885Critical
CloudPanel 2 before version 2.3.1 has insecure cookie authentication in the file manager.
- CVE-2024-44765Medium
A vulnerability in CloudPanel versions 2.0.0 through 2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.
- CVE-2023-36630High
In CloudPanel before version 2.3.1, insecure file upload leads to privilege escalation and authentication bypass.
- CVE-2023-33747High
CloudPanel version 2.2.2 allows attackers to execute a path traversal attack.
Original NVD description (English source)
A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS