Critical Convoy Flaw Allows Remote Code Execution on Servers

A critical vulnerability (CVE-2025-52562) in Performave Convoy—a KVM server management panel widely used by hosting providers—enables unauthenticated attackers to execute arbitrary code on affected systems.

Rated the maximum CVSS score of 10.0, this flaw exposes servers to complete compromise without requiring authentication.

Vulnerability Summary

According to the Github report, the flaw resides in Convoy’s LocaleController component, where improper input validation allows directory traversal attacks.

Attackers craft malicious HTTP requests with manipulated locale and namespace parameters to traverse directories and include arbitrary PHP files. This leads to:

• Remote Code Execution (RCE): Full server control with SYSTEM-level privileges.
• Sensitive Data Theft: Access to .env files containing database credentials, API keys, and secrets.
• Unauthenticated Exploitation: No credentials required, making all exposed instances immediately vulnerable.

Attribute	Details
CVE ID	CVE-2025-52562
CVSS Score	10.0 (Critical)
Affected Versions	Convoy 3.9.0-rc3 to 4.4.0
Patched Version	4.4.1
Attack Vector	Network-based, unauthenticated
Impact	Remote Code Execution, Data Exfiltration

Attackers exploit insufficient sanitization of user-supplied inputs in HTTP parameters:

• locale Parameter: Must be forced to “en_US en”; any deviation enables traversal.
• namespace Parameter: Accepts only A-Z, a-z, _, ., and spaces (1–191 chars), rejecting .. or URL-encoded variants.
  Successful exploitation chains directory traversal with PHP file inclusion, executing malicious payloads like reverse shells or cron-based persistence scripts.

Mitigation Steps

1. Immediate Patching: Upgrade to Convoy 4.4.1 or later.
2. WAF Rules: Enforce strict input validation:
   • Restrict locale to “en_US en” exclusively.
   • Limit namespace to alphanumeric characters, underscores, periods, and spaces; block .. sequences.
3. Monitoring: Detect abnormal PHP execution, unexpected cron jobs, or outgoing connections to suspicious IPs.

This vulnerability underscores systemic risks in management panels, particularly where default configurations lack input hardening.

Hosting providers and enterprises using Convoy must prioritize patching, as unpatched systems are actively exploitable in ransomware and data exfiltration campaigns

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates