CVE-2025-53534

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.

Summary

• When an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in.
• In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access.

Details

In Go, r.URL.Path retrieves the part of the URL that comes after the port and before the query parameters or anchor symbols. For example, in the URL http://localhost:8080/api/ws/ssh?id=1, the retrieved path would be /api/ws/ssh.

However, if the request is made to http://localhost:8080//api/ws/ssh?id=1, the parsed r.URL.Path would be //api/ws/ssh.

RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, The route path inside the chi router will be cleaned to /api/ws/ssh, but this middleware does not process r.URL.Path, so the path is still //api/ws/ssh.

In the must_login middleware, RatPanel uses r.URL.Path to match the hard-coded prefix whitelist, because /api/ws does not match //api/ws. The must_login middleware will allow the request, but //api/ws has been cleaned to /api/ws in the chi router. This inconsistency leads to authentication bypass and accessing the dangerous interfaces such as /api/ws/exec and /api/ws/ssh.

But there are some limitations. Before exploiting this interface, the attacker must first identify the correct backend address of ratpanel to activate session legitimacy—specifically, to ensure sess.Put("verify_entrance", true). That said, accessing /api/ws only requires activating the session and does not require completing further authentication or login steps. Therefore, this is assessed to be a remotely exploitable command execution vulnerability with moderate severity.

PoC

I first carried session=......, accessed the backend login page normally (without completing the authentication process), activated the session, and then used the _wsdump.py script provided by the Python websocket-client library to complete the authentication and exploit the vulnerability.

Because of the authorization code

// internal/http/middleware/must_login.go
if slices.Contains(whiteList, r.URL.Path) || !strings.HasPrefix(r.URL.Path, "/api") {
    next.ServeHTTP(w, r)
    return
}

This vulnerability affects the authorization mechanism across all APIs, for example

This authentication vulnerability appears to affect versions v2.3.19 to v2.5.5.

Data packet

GET //api/...... HTTP/2
Host: IP:PORT
Cookie: session=XXXXXX
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Connection: close

python _wsdump.py wss://ip:port//api/ws/exec --headers "Cookie: session=xxxxxx" -n

Impact

Users running Ratpanel versions v2.3.19 to v2.5.5—especially those who have exposed their admin panel login URL or use weak login URL paths—are vulnerable to unauthorized access. Additionally, versions…

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.

RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6.

Summary

• When an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in.
• In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access.

Details

In Go, r.URL.Path retrieves the part of the URL that comes after the port and before the query parameters or anchor symbols. For example, in the URL http://localhost:8080/api/ws/ssh?id=1, the retrieved path would be /api/ws/ssh.

However, if the request is made to http://localhost:8080//api/ws/ssh?id=1, the parsed r.URL.Path would be //api/ws/ssh.

RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, The route path inside the chi router will be cleaned to /api/ws/ssh, but this middleware does not process r.URL.Path, so the path is still //api/ws/ssh.

In the must_login middleware, RatPanel uses r.URL.Path to match the hard-coded prefix whitelist, because /api/ws does not match //api/ws. The must_login middleware will allow the request, but //api/ws has been cleaned to /api/ws in the chi router. This inconsistency leads to authentication bypass and accessing the dangerous interfaces such as /api/ws/exec and /api/ws/ssh.

But there are some limitations. Before exploiting this interface, the attacker must first identify the correct backend address of ratpanel to activate session legitimacy—specifically, to ensure sess.Put("verify_entrance", true). That said, accessing /api/ws only requires activating the session and does not require completing further authentication or login steps. Therefore, this is assessed to be a remotely exploitable command execution vulnerability with moderate severity.

PoC

I first carried session=......, accessed the backend login page normally (without completing the authentication process), activated the session, and then used the _wsdump.py script provided by the Python websocket-client library to complete the authentication and exploit the vulnerability.

Because of the authorization code

// internal/http/middleware/must_login.go
if slices.Contains(whiteList, r.URL.Path) || !strings.HasPrefix(r.URL.Path, "/api") {
    next.ServeHTTP(w, r)
    return
}

This vulnerability affects the authorization mechanism across all APIs, for example

This authentication vulnerability appears to affect versions v2.3.19 to v2.5.5.

Data packet

GET //api/...... HTTP/2
Host: IP:PORT
Cookie: session=XXXXXX
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/json; charset=UTF-8
Connection: close

python _wsdump.py wss://ip:port//api/ws/exec --headers "Cookie: session=xxxxxx" -n

Impact

Users running Ratpanel versions v2.3.19 to v2.5.5—especially those who have exposed their admin panel login URL or use weak login URL paths—are vulnerable to unauthorized access. Additionally, versions…

RatPanel can perform remote command execution without authorization in github.com/tnborg/panel in github.com/TheTNB/panel.

NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.

(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)

The additional affected modules and versions are: github.com/TheTNB/panel/v2 from v2.3.19 before v2.5.6; github.com/tnb-labs/panel from v2.3.19 before v2.5.6.

These are all security issues fixed in the govulncheck-vulndb-0.0.20250811T192933-1.1 package on the GA media of openSUSE Tumbleweed.

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20250814T182633 2025-08-14T18:26:33Z (jsc#PED-11136)

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3765 CVE-2024-44906 GHSA-h4h6-vccr-44h2
  • GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp

• Update to version 0.0.20250811T192933 2025-08-11T19:29:33Z (jsc#PED-11136)

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3822 CVE-2025-53942 GHSA-9g4j-v8w5-7x42
  • GO-2025-3829 CVE-2025-54410 GHSA-4vq8-7jfc-9cvp
  • GO-2025-3830 CVE-2025-54388 GHSA-x4rx-4gw3-53p4
  • GO-2025-3831 CVE-2025-50738 GHSA-hfcf-79gh-f3jc
  • GO-2025-3832 CVE-2021-21411 GHSA-652x-m2gr-hppm
  • GO-2025-3833 CVE-2025-54576 GHSA-7rh7-c77v-6434
  • GO-2025-3834 CVE-2025-54424 GHSA-8j63-96wh-wh3j
  • GO-2025-3835 CVE-2025-54386 GHSA-q6gg-9f92-r9wg
  • GO-2025-3836 CVE-2025-6037 GHSA-6c5r-4wfc-3mcx
  • GO-2025-3837 CVE-2025-5999 GHSA-6h4p-m86h-hhgh
  • GO-2025-3838 CVE-2025-6000 GHSA-mr4h-qf9j-f665
  • GO-2025-3839 CVE-2025-6011 GHSA-mwgr-84fv-3jh9
  • GO-2025-3840 CVE-2025-6004 GHSA-qgj7-fmq2-6cc4
  • GO-2025-3841 CVE-2025-6014 GHSA-qv3p-fmv3-9hww
  • GO-2025-3842 CVE-2025-6015 GHSA-v6r4-35f9-9rpw
  • GO-2025-3843 CVE-2025-8341 GHSA-3c93-92r7-j934
  • GO-2025-3844 CVE-2025-53534 GHSA-fm3m-jrgm-5ppg
  • GO-2025-3845 CVE-2025-54801 GHSA-qx2q-88mx-vhg7
  • GO-2025-3847 CVE-2025-54799 GHSA-q82r-2j7m-9rv4
  • GO-2025-3848 CVE-2025-6013 GHSA-7rx2-769v-hrwf
  • GO-2025-3851 CVE-2025-44779 GHSA-93jv-pvg8-hf3v
  • GO-2025-3852 CVE-2025-7195 GHSA-856v-8qm2-9wjv
  • GO-2025-3853 CVE-2025-55000 GHSA-f7c3-mhj2-9pvg
  • GO-2025-3854 CVE-2025-54999 GHSA-hh28-h22f-8357
  • GO-2025-3855 CVE-2025-54998 GHSA-j3xv-7fxp-gfhx
  • GO-2025-3856 CVE-2025-55003 GHSA-rxp7-9q75-vj3p
  • GO-2025-3857 CVE-2025-54996 GHSA-vf84-mxrq-crqc
  • GO-2025-3858 CVE-2025-54997 GHSA-xp75-r577-cvhp
  • GO-2025-3859 CVE-2025-55001 GHSA-2q8q-8fgw-9p6p

• Update to version 0.0.20250807T150727 2025-08-07T15:07:27Z (jsc#PED-11136)

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2025-3849 CVE-2025-47907