CVE-2025-15241 MEDIUM

CVE-2025-15241: CloudPanel Community Edition HTTP Header users redirect

Vendor Cloudpanel
Product Community Edition
Weakness CWE-601 · Open redirect
Published December 30, 2025
Last update December 30, 2025
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction —
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

What the vulnerability does

01Description

A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of the component HTTP Header Handler. Such manipulation of the argument Referer leads to open redirect. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.5.2 is sufficient to fix this issue. Upgrading the affected component is recommended.

Key dates

02Disclosure timeline

December 30, 2025 CVE published
December 30, 2025 Record updated