CVE-2024-39907
Critical · 9.8CVSS
9.8
EPSS
29.2%
Published
Jul 18, 2024
CISA due date
—
The record
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/1Panel-dev/1Panel | 0 | No fix |
| Go | github.com/1Panel-dev/1Panel | 0 | 1.10.12-tls |
Related vulnerabilities
- GO-2025-4230 1Panel contains a cross-site request forgery (CSRF) vulnerability in the panel name… Also affects github.com/1Panel-dev/1Panel
- GO-2025-4229 1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username… Also affects github.com/1Panel-dev/1Panel
- GO-2025-4231 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port… Also affects github.com/1Panel-dev/1Panel
- GO-2025-4209 1Panel – CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel Also affects github.com/1Panel-dev/1Panel
- GO-2025-4207 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers in… Also affects github.com/1Panel-dev/1Panel
- CVE-2025-34430 1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF)… Also affects github.com/1Panel-dev/1Panel
- CVE-2025-34410 1Panel contains a cross-site request forgery (CSRF) vulnerability in the Change Username… Also affects github.com/1Panel-dev/1Panel
- CVE-2025-34429 1Panel contains a cross-site request forgery (CSRF) vulnerability in the web port… Also affects github.com/1Panel-dev/1Panel