CVE-2024-2563

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path traversal: '../filedir'. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-257062 is the identifier assigned to this vulnerability.

• CWE-24

• https://github.com/PandaXGO/PandaX/pull/3Issue Tracking, Patch
• https://vuldb.com/?ctiid.257062Permissions Required, VDB Entry
• https://vuldb.com/?id.257062Permissions Required, VDB Entry
• https://github.com/PandaXGO/PandaX/pull/3Issue Tracking, Patch
• https://vuldb.com/?ctiid.257062Permissions Required, VDB Entry
• https://vuldb.com/?id.257062Permissions Required, VDB Entry

Published

Mar 17, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25624Iris is a web collaborative platform aiming to help incident…6.8
• CVE-2024-25625Pimcore's Admin Classic Bundle provides a Backend UI for Pim…9.3
• CVE-2024-25626Yocto Project is an open source collaboration project that h…9.8
• CVE-2024-25627Alf.io is a free and open source event attendance management…4.8
• CVE-2024-25628Alf.io is a free and open source event attendance management…7.6
• CVE-2024-25629c-ares is a C library for asynchronous DNS requests. `ares__…5.5
• CVE-2024-25630Cilium is a networking, observability, and security solution…5.3
• CVE-2024-25631Cilium is a networking, observability, and security solution…5.3
• CVE-2024-25632eLabFTW is an open source electronic lab notebook for resear…8.8
• CVE-2024-25633eLabFTW is an open source electronic lab notebook for resear…5.4
• CVE-2024-25634alf.io is an open source ticket reservation system. Prior to…6.5
• CVE-2024-25635alf.io is an open source ticket reservation system. Prior to…8.8