CVE-2024-2563 is a medium severity (CVSS 5.4) path traversal in PandaX up to the 20240310 build. The DeleteImage function in upload.go uses the fileName argument as a path. The record links an upstream pull request but names no release, so verify the fix.
What's affected
PandaX up to 20240310, per the record. The affected function is DeleteImage in /apps/system/router/upload.go and the argument is fileName. The record gives the weakness as CWE-24, the ../filedir form of path traversal, and links an upstream pull request.
The NVD record scores it 5.4 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-24 (path traversal using the ../filedir pattern).
The record names no fixed release. It links a pull request in the PandaXGO repository. I did not confirm that it was merged, so check the project history for the change.
How to check if you're exposed
Check your build's commit date, then read the function:
git log -1 --format=%cd
grep -n "DeleteImage" apps/system/router/upload.go
A build dated on or before 10 March 2024 is in the affected range.
What to do now
- Check the commit date of your PandaX build.
- Find the upstream pull request and confirm it is merged in your version.
- Update, or add a check that the resolved path stays inside the upload folder.
- Run the service as an account with write access only to the upload directory.
- Review file system and access logs for deletions you did not expect.
Why it matters
The weakness is path traversal. A file name or path from the request is joined to a base folder without being normalised and confined to that folder, so sequences that climb up directories can point the operation at files elsewhere on the host. Depending on the function that can mean reading, overwriting or deleting files outside the intended folder.
The fix is to resolve the final path and confirm it still sits under the intended base directory, reject absolute paths and parent directory segments, and give the service account only the file rights it needs.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
Can this delete files?
The function name is DeleteImage and the record describes path traversal on its file name argument, so a delete outside the intended folder is the concern. The record does not describe a specific impact beyond that.
Sources
Last reviewed: 19 October 2026.
