Vulnerability · Published Dec 30, 2025 · Assigned by VulDB

CVE-2025-15241CloudPanel Community Edition HTTP Header users redirect

Low 3.5

In plain English

A low-severity open redirect in Community Edition from CloudPanel. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).

Severity (CVSS 3.1)3.5Low

Exploit odds (30 days)0.2%top 87.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.

Affected products (as reported)

Vendor	Product	Versions
CloudPanel	Community Edition	2.5.02.5.1

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

References

VDB-338631 | CloudPanel Community Edition HTTP Header users redirect vdb-entry, technical-description
VDB-338631 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
Submit #725543 | CloudPanel CloudPanel Community Edition 2.5.1 URL Redirection to Untrusted Site ('Open Redirect') third-party-advisory
https://github.com/Stolichnayer/cloudpanel-open-redirect related
https://github.com/Stolichnayer/cloudpanel-open-redirect?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce exploit
https://github.com/cloudpanel-io/cloudpanel-ce/releases/tag/v2.5.2 patch