Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
14 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The server trusts all reverse-proxy headers by default, so any remote client can spoof X-Forwarded-For to bypass IP-based protections (AllowIPs, API IP whitelist, “localhost-only” checks). All IP-based access control becomes ineffective. Details - Gin is created with defaults (gin.Default()), which sets TrustedProxies = 0.0.0.0/0 and uses X-Forwarded-For/X-Real-IP to compute ClientIP(). - IP-based controls rely on ClientIP(): - AllowIPs / BindDomain (core/middleware/iplimit.go, core/utils/security/security.go). - API IP whitelist (core/middleware/apiauth.go). - "localhost-only" checks that depend on ClientIP(). - Because no trusted-proxy range is enforced, any client can send X-Forwarded-For: 127.0.0.1 (or a whitelisted IP) and be treated as coming from that address. Impact All IP-based access control is rendered ineffective: remote clients can masquerade as localhost or any whitelisted IP, defeating AllowIPs, API IP whitelists, and “localhost-only” protections.
Recommended action: Upgrade to 2.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A CAPTCHA bypass vulnerability in the 1Panel authentication API allows an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previously trusted this value without proper validation, CAPTCHA protections could be bypassed, enabling automated login attempts and significantly increasing the risk of account takeover (ATO). Details The /api/login endpoint accepts a boolean field named ignoreCaptcha directly from the client request body: "ignoreCaptcha": true The backend implementation uses this value to determine whether CAPTCHA validation should be performed: Because req.IgnoreCaptcha is taken directly from user input—with no server-side validation, no session binding, and no privilege checks—any unauthenticated attacker can force CAPTCHA validation to be skipped. There are no additional conditions, such as: no requirement for MFA no trusted device no IP reputation checks no prior valid session no rate limiting…
Recommended action: Upgrade to 2.0.14 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The proof is as follows Details （one of them ） <img width="697" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/895b7b43-9bc0-44b3-9c84-24c2dcc962da" <img width="936" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/1b8eb866-9865-4bef-a359-53335d709157" <img width="684" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/e865d6d0-7ecb-49f7-b4a2-f1b0bc407986" PoC curl 'http://api:30455/api/v1/hosts/command/search' {"page":1,"pageSize":10,"groupID":0,"orderBy":"3","order":"ascending","name":"a"} <img width="664" alt="image" src="https://github.com/1Panel-dev/1Panel/assets/129351704/250d5a2a-cb32-44dc-9831-86dbc2f2b43f" for example as picture . just change orderby‘s num we can know How many columns does the data table have.Parameters require strict whitelist…
Recommended action: Upgrade to 1.10.12-tls (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. We can use the following mirror configuration write symbol to achieve arbitrary file writing PoC Dockerfile echo.sh Build this image like this, upload it to dockerhub, and then 1panel pulls the image to build the container Send the following packet, taking care to change the containerID to the malicious container we constructed Then you can write any customized file to, for example, a ssh key, and generally the application is run with root privileges Or write a timed task to execute any command. Impact The ability to write arbitrary files on the host where the service is deployed can lead to a host takeover
Recommended action: Upgrade to 1.10.3-lts (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
源码中密码校验处使用 != 符号，而不是hmac.Equal，这可能导致产生计时攻击漏洞，从而爆破密码。 建议使用 hmac.Equal 比对密码。 Translation: The source code uses the != symbol instead of hmac.Equal for password verification, which may lead to timing attack vulnerabilities that can lead to password cracking. It is recommended to use hmac. Equal to compare passwords. Details https://github.com/1Panel-dev/1Panel/blob/dev/backend/app/service/auth.go#L81C5-L81C26 Impact 该产品的所有使用者。 Translation: All users of this product.
Recommended action: Upgrade to 1.10.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
1Panel is vulnerable to command injection. This vulnerability has been classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.
Recommended action: Upgrade to 1.10.1-lts (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The steps are as follows: 1. Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point. 2. Use Burp to intercept: When opening the browser and entering the URL (allowing the first intercepted packet through Burp), the following is displayed: It is found that in this situation, we can access the console page (although no data is returned and no modification operations can be performed)." Affected versions: <= 1.10.0-lts Patches The vulnerability has been fixed in v1.10.1-lts. Workarounds It is recommended to upgrade the version to 1.10.1-lts. References If you have any questions or comments about this advisory: Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com
Recommended action: Upgrade to 1.10.1-lts (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The https cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text when accessing http accidentally. https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Set-Cookie#secure PoC Directly configure https for the panel, and then capture the packet when logging in again and find that the cookie does not have the Secure keyword Impact Everyone who has configured the panel https
Recommended action: Upgrade to 1.9.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/1Panel-dev/1Panel >= 1.4.3, <= 1.4.3
Fixed in
1.5.0· Vendor fix available
Issue
An arbitrary file write vulnerability could lead to direct control of the server Details Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this: - Vulnerable Code PoC - We can write the SSH public key into the /etc/.root/authorizedkeys configuration file on the server. - The server was successfully written to the public key - Successfully connected to the target server using an SSH private key. As a result, the server is directly controlled, causing serious harm Impact 1Panel v1.4.3
Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/1Panel-dev/1Panel >= 1.4.3, <= 1.4.3
Fixed in
1.5.0· Vendor fix available
Issue
Any file downloading vulnerability exists in 1Panel backend. Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. PoC payload: POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json {"path":"/etc/passwd"} Impact Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.
Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Go github.com/1Panel-dev/1Panel >= 1.4.3, <= 1.4.3
Fixed in
1.5.0· Vendor fix available
Issue
Arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. Details In the api/v1/file.go file, there is a function called LoadFromFile, which directly reads the file by obtaining the requested path parameter[path]. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability PoC Request /api/v1/files/loadfile, carry /etc/passwd data to read, as shown below: Impact 1Panel v1.4.3
Recommended action: Upgrade to 1.5.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. Details 1Panel firewall functionality /hosts/firewall/ip endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. PoC the payload ; sleep 3 will lead server response in 3 seconds the payload ; sleep 6 will lead server response in 6 seconds Impact An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. Patches The vulnerability has been fixed in v1.4.3. Workarounds It is recommended to upgrade the version to v1.4.3. References If you have any questions or comments about this advisory: Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com
Recommended action: Upgrade to 1.4.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. 1. Vulnerability analysis. 2. vulnerability reproduction. 3. The successful execution of system commands. Affected versions: <= 1.3.5 Patches The vulnerability has been fixed in v1.3.6. Workarounds It is recommended to upgrade the version to v1.3.6. References If you have any questions or comments about this advisory: Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com
Recommended action: Upgrade to 1.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. 1. Vulnerability analysis. 2. vulnerability reproduction. 3. Using update can be triggered multiple times. Affected versions: <= 1.3.5 Patches The vulnerability has been fixed in v1.3.6. Workarounds It is recommended to upgrade the version to v1.3.6. References If you have any questions or comments about this advisory: Open an issue in https://github.com/1Panel-dev/1Panel Email us at wanghe@fit2cloud.com
Recommended action: Upgrade to 1.3.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.