CVE-2024-53584

CVE-2024-53584 is an OS command injection vulnerability affecting OpenPanel version 0.3.4, exploitable through the timezone parameter. Published on 2025-01-31, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), classifying it as critical, and maps to CWE-78 for improper neutralization of special elements in OS commands.

Remote attackers require no authentication, privileges, or user interaction and can exploit the flaw over the network with low attack complexity. Successful exploitation enables arbitrary OS command execution, granting high-impact access to confidentiality, integrity, and availability, which could lead to full system compromise.

Advisories reference OpenPanel's changelog for version 0.3.5, which includes security fixes for this issue (https://openpanel.com/docs/changelog/0.3.5/#%EF%B8%8F-security-fixes). Further technical details are available on PacketStorm (https://packetstorm.news/files/id/188915/).