What’s Vulnerable › Vulnerabilities

CVE-2024-33615: CyberPower PowerPanel business Relative Path Traversal

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-15 · updated 2026-06-17
• Weakness: CWE-23

Description

A specially crafted Zip file containing path traversal characters can be imported to the CyberPower PowerPanel server, which allows file writing to the server outside the intended scope, and could allow an attacker to achieve remote code execution.

Affected products

• CyberPower Powerpanel Business: before 4.9.0 — fixed in 4.9.0

How to fix

Upgrade to a fixed version: CyberPower Powerpanel Business 4.9.0. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-123-01
• https://www.cyberpower.com/global/en/product/sku/powerpanel_business_for_windows#downloads

Get alerted when CVE-2024-33615 or the next vulnerability affects your stack