CVE-2025-53534 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2025-53534 Interim 1 5 2026-03-05T00:31:04Z current 2025-08-13T23:15:19Z 2026-03-05T00:31:04Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2025-53534 RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-updates/2025-August/041294.html E-Mail link for SUSE-SU-2025:02912-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE SUSE Linux Enterprise Server 16.0 openSUSE Tumbleweed ca-certificates-mozilla-2.84-slfo.1.1_1.1 govulncheck-vulndb-0.0.20250811T192933-1.1 govulncheck-vulndb-0.0.20250814T182633-160000.1.2 shim-15.8-1.1 ca-certificates-mozilla-2.84-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest shim-15.8-1.1 as a component of Container suse/sl-micro/6.0/base-os-container:latest ca-certificates-mozilla-2.84-slfo.1.1_1.1 as a component of Container suse/sl-micro/6.0/toolbox:latest ca-certificates-mozilla-2.84-slfo.1.1_1.1 as a component of Image SL-Micro shim-15.8-1.1 as a component of Image SL-Micro ca-certificates-mozilla-2.84-slfo.1.1_1.1 as a component of Image SLE-Micro shim-15.8-1.1 as a component of Image SLE-Micro shim-15.8-1.1 as a component of Image SLE-Micro-Azure shim-15.8-1.1 as a component of Image SLE-Micro-BYOS shim-15.8-1.1 as a component of Image SLE-Micro-BYOS-Azure shim-15.8-1.1 as a component of Image SLE-Micro-BYOS-EC2 shim-15.8-1.1 as a component of Image SLE-Micro-BYOS-GCE ca-certificates-mozilla-2.84-slfo.1.1_1.1 as a component of Image SLE-Micro-EC2 shim-15.8-1.1 as a component of Image SLE-Micro-EC2 shim-15.8-1.1 as a component of Image SLE-Micro-GCE govulncheck-vulndb-0.0.20250814T182633-160000.1.2 as a component of SUSE Linux Enterprise Server 16.0 govulncheck-vulndb-0.0.20250811T192933-1.1 as a component of openSUSE Tumbleweed RatPanel is a server operation and maintenance management panel. In versions 2.3.19 through 2.5.5, when an attacker obtains the backend login path of RatPanel (including but not limited to weak default paths, brute-force cracking, etc.), they can execute system commands or take over hosts managed by the panel without logging in. In addition to this remote code execution (RCE) vulnerability, the flawed code also leads to unauthorized access. RatPanel uses the CleanPath middleware provided by github.com/go-chi/chi package to clean URLs, but but the middleware does not process r.URL.Path, which can cause the paths to be misinterpreted. This is fixed in version 2.5.6. CVE-2025-53534 Container suse/sl-micro/6.0/base-os-container:latest:ca-certificates-mozilla-2.84-slfo.1.1_1.1 Container suse/sl-micro/6.0/base-os-container:latest:shim-15.8-1.1 Container suse/sl-micro/6.0/toolbox:latest:ca-certificates-mozilla-2.84-slfo.1.1_1.1 Image SL-Micro:ca-certificates-mozilla-2.84-slfo.1.1_1.1 Image SL-Micro:shim-15.8-1.1 Image SLE-Micro:ca-certificates-mozilla-2.84-slfo.1.1_1.1 Image SLE-Micro:shim-15.8-1.1 Image SLE-Micro-Azure:shim-15.8-1.1 Image SLE-Micro-BYOS:shim-15.8-1.1 Image SLE-Micro-BYOS-Azure:shim-15.8-1.1 Image SLE-Micro-BYOS-EC2:shim-15.8-1.1 Image SLE-Micro-BYOS-GCE:shim-15.8-1.1 Image SLE-Micro-EC2:ca-certificates-mozilla-2.84-slfo.1.1_1.1 Image SLE-Micro-EC2:shim-15.8-1.1 Image SLE-Micro-GCE:shim-15.8-1.1 SUSE Linux Enterprise Server 16.0:govulncheck-vulndb-0.0.20250814T182633-160000.1.2 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250811T192933-1.1 not set