CVE-2024-2564 is a medium severity (CVSS 6.3) path traversal in PandaX up to the 20240310 build. The ExportUser function in user.go uses the filename argument as a path. The record names no fixed release, so check the project. The sections below cover how to check your exposure and what to do.
What's affected
PandaX up to 20240310, per the record. The affected function is ExportUser in /apps/system/api/user.go and the argument is filename. The weakness is CWE-24, the ../filedir form of path traversal. The record links an issue in the project. Export functions are worth a close look because they write files whose names a user can influence, and the same pattern may exist in other PandaX handlers that take file names.
The NVD record scores it 6.3 (medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, published 2024-03-17. The weakness is classed as CWE-24 (path traversal using the ../filedir pattern).
The record names no fixed release and links an issue, not a release note. Check the PandaXGO commits made after 10 March 2024.
How to check if you're exposed
Check your build's commit date, then read the function:
git log -1 --format=%cd
grep -n "ExportUser" apps/system/api/user.go
A build dated on or before 10 March 2024 is in the affected range.
What to do now
- Check the commit date of your PandaX build.
- Follow the linked issue and the project commits for a fix.
- Update, or confine the export file name to a fixed folder in code.
- Restrict the export function to administrators.
- Review logs for export requests with unusual file names.
Why it matters
The weakness is path traversal. A file name or path from the request is joined to a base folder without being normalised and confined to that folder, so sequences that climb up directories can point the operation at files elsewhere on the host. Depending on the function that can mean reading, overwriting or deleting files outside the intended folder.
The fix is to resolve the final path and confirm it still sits under the intended base directory, reject absolute paths and parent directory segments, and give the service account only the file rights it needs.
This CVE is not on the CISA Known Exploited Vulnerabilities list (the record's KEV flag is false). Exploit details are not repeated here, because this guide is about defence.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan lists the open source packages in a project and flags known vulnerabilities, and the Gold directory tracks this CVE. Reachability analysis helps decide which findings in your own code actually matter.
Quick check
Is this a duplicate of CVE-2024-2563?
No. Both are path traversal in PandaX, but they sit in different functions and files, so each needs its own fix.
Sources
Last reviewed: 19 October 2026.
