Low severity · published Dec 30, 2025
CVE-2025-15241
CloudPanel Community Edition HTTP Header users redirect
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CE
Community Edition · CloudPanel
2.5.0; 2.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15241
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15241
github.com
https://github.com/Stolichnayer/cloudpanel-open-redirect
github.com
https://github.com/Stolichnayer/cloudpanel-open-redirect?tab=readme-ov-file#%EF%B8%8F-steps-to-reproduce
github.com
https://github.com/cloudpanel-io/cloudpanel-ce/releases/tag/v2.5.2
vuldb.com
https://vuldb.com/?ctiid.338631
vuldb.com
https://vuldb.com/?id.338631
vuldb.com
https://vuldb.com/?submit.725543