# github.com/1Panel-dev/1Panel (Go) vulnerabilities

18 known vulnerabilities (2 critical, 6 high, 9 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/1Panel-dev/1Panel

## Advisories (18)

### [CVE-2025-34429](https://cve.now/CVE-2025-34429): 1Panel CSRF Web Port Configuration Change

- Severity: High 7.0
- Published: Dec 10, 2025
- Affected: from 1.10.33, through 2.0.15; all versions.

### [CVE-2025-34430](https://cve.now/CVE-2025-34430): 1Panel CSRF Panel Name Modification

- Severity: Medium 5.1
- Published: Dec 10, 2025
- Affected: from 1.10.33, through 2.0.15; all versions.

### [CVE-2025-34410](https://cve.now/CVE-2025-34410): 1Panel CSRF in Change Username Functionality Allows Account Lockout

- Severity: High 7.0
- Published: Dec 10, 2025
- Affected: from 1.10.33, through 2.0.15; all versions.

### [CVE-2025-66508](https://cve.now/CVE-2025-66508): 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers

- Severity: Medium 6.5
- Published: Dec 9, 2025
- Affected: fixed in 2.0.14+incompatible; fixed in 2.0.14.

### [CVE-2025-66507](https://cve.now/CVE-2025-66507): 1Panel – CAPTCHA Bypass via Client-Controlled Flag

- Severity: High 7.5
- Published: Dec 9, 2025
- Affected: fixed in 2.0.14+incompatible; fixed in 2.0.14.

### [CVE-2024-39911](https://cve.now/CVE-2024-39911): 1Panel SQL injection

- Severity: Critical 10.0
- Published: Jul 18, 2024
- Affected: fixed in 1.10.12-lts.

### [CVE-2024-39907](https://cve.now/CVE-2024-39907): a sqlinjection in 1Panel

- Severity: Critical 9.8
- Published: Jul 18, 2024
- Affected: all versions; fixed in 1.10.12-tls.

### [CVE-2024-34352](https://cve.now/CVE-2024-34352): Arbitrary file write vulnerability in 1Panel

- Severity: Medium 6.5
- Published: May 9, 2024
- Affected: fixed in 1.10.3-lts.

### [CVE-2024-30257](https://cve.now/CVE-2024-30257): 1Panel's password verification is suspected to have a timing attack vulnerability

- Severity: Low 3.9
- Published: Apr 18, 2024
- Affected: fixed in 1.10.3; all versions.

### [CVE-2024-2352](https://cve.now/CVE-2024-2352): 1Panel swap baseApi.UpdateDeviceSwap command injection

- Severity: Medium 6.3
- Published: Mar 10, 2024
- Affected: fixed in 1.10.1-lts.

### [CVE-2024-27288](https://cve.now/CVE-2024-27288): 1Panel open source panel project has an unauthorized vulnerability.

- Severity: Medium 6.3
- Published: Mar 6, 2024
- Affected: fixed in 1.10.1-lts.

### [CVE-2024-24768](https://cve.now/CVE-2024-24768): 1Panel set-cookie is missing the Secure keyword

- Severity: Medium 6.5
- Published: Feb 5, 2024
- Affected: fixed in 1.9.6.

### [CVE-2023-39966](https://cve.now/CVE-2023-39966): 1Panel arbitrary file write vulnerability exists in the background

- Severity: High 7.5
- Published: Aug 10, 2023
- Affected: from 1.4.3, fixed in 1.5.0; from 1.4.3, fixed in 1.5.0.

### [CVE-2023-39965](https://cve.now/CVE-2023-39965): 1Panel Unauthorized access in Backend

- Severity: Medium 6.5
- Published: Aug 10, 2023
- Affected: from 1.4.3, fixed in 1.5.0; from 1.4.3, fixed in 1.5.0.

### [CVE-2023-39964](https://cve.now/CVE-2023-39964): 1Panel O&M management panel has a background arbitrary file reading vulnerability

- Severity: High 7.5
- Published: Aug 10, 2023
- Affected: from 1.4.3, fixed in 1.5.0; from 1.4.3, fixed in 1.5.0.

### [CVE-2023-37477](https://cve.now/CVE-2023-37477): Command injection in firewall ip functionality in 1Panel

- Severity: High 7.2
- Published: Jul 18, 2023
- Affected: fixed in 1.4.3.

### [CVE-2023-36457](https://cve.now/CVE-2023-36457): 1Panel vulnerable to command injection when adding container repositories

- Severity: Medium 6.3
- Published: Jul 5, 2023
- Affected: fixed in 1.3.6.

### [CVE-2023-36458](https://cve.now/CVE-2023-36458): 1Panel vulnerable to ommand injection when entering the container terminal

- Severity: Medium 6.3
- Published: Jul 5, 2023
- Affected: fixed in 1.3.6.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/1panel-dev/1panel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.