github.com/1Panel-dev/1Panel
Go14 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting github.com/1Panel-dev/1Panelpage 1 of 1
- CVE-2023-36457MEDIUMCVSS 6.3EG 6.3✓ Fixed in 1.3.62023-07-05
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerab…
- CVE-2023-36458MEDIUMCVSS 6.3EG 6.3✓ Fixed in 1.3.62023-07-05
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulne…
- CVE-2023-37477HIGHCVSS 7.2EG 7.2✓ Fixed in 1.4.32023-07-18
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An a…
- CVE-2023-39964HIGHCVSS 7.5EG 7.5✓ Fixed in 1.5.02023-08-10
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there i…
- CVE-2023-39965MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.5.02023-08-10
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely dow…
- CVE-2023-39966HIGHCVSS 7.5EG 7.5✓ Fixed in 1.5.02023-08-10
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called …
- CVE-2024-2352MEDIUMCVSS 6.3EG 6.3✓ Fixed in 1.10.1-lts2024-03-10
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument …
- CVE-2024-24768MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.9.62024-02-05
1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This…
- CVE-2024-27288MEDIUMCVSS 6.3EG 6.3✓ Fixed in 1.10.1-lts2024-03-06
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access to the console page. The vulnerability has been fixed in v1.10.1-lts. There are…
- CVE-2024-30257LOWCVSS 3.9EG 3.92024-04-18
1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac.Equal. This may lead to a timing attack vulnerability. This vulnerability is fix…
- CVE-2024-34352MEDIUMCVSS 6.5EG 6.5✓ Fixed in 1.10.3-lts2024-05-14
1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultima…
- CVE-2024-39907CRITICALCVSS 9.8EG 9.82024-07-18
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have …
- CVE-2024-39911CRITICALCVSS 10.0EG 10.0✓ Fixed in 1.10.12-lts2024-07-18
1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known worka…
- CVE-2025-66507HIGHCVSS 7.5EG 7.5✓ Fixed in 2.0.142025-12-09
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previou…
Check whether github.com/1Panel-dev/1Panel is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for github.com/1Panel-dev/1Panel CVEs against the assets you own.
Start Free Scan →