Remote Command Execution Vulnerability in ZPanel by ZPanel Team
CVE-2013-10053
Key Information:
- Vendor
Zpanel Project
- Status
- Vendor
- CVE Published:
- 1 August 2025
Badges
What is CVE-2013-10053?
A serious vulnerability exists in ZPanel version 10.0.0.2 within its htpasswd module, allowing authenticated users to exploit an unsanitized input issue. When creating .htaccess files, the inHTUsername field is passed directly to a system() call that references the htpasswd binary, presenting a risk where shell metacharacters can be injected. This flaw permits an authenticated attacker—without needing elevated privileges—to execute arbitrary system commands, potentially compromising the entire system.
Affected Version(s)
ZPanel * <= 10.0.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V4
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved