Read the docs
TI-2023-19085 Aliases CVE-2023-37477GHSA-p9xf-74xh-mhw5

Command injection in firewall ip functionality in 1Panel

Priority HIGH 73CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability. 1Panel firewall functionality `/hosts/firewall/ip` endpoint read user input without validation, the attacker extends the default functionality of the application, which execute system commands. An attacker can execute arbitrary code on the target system, which can lead to a complete compromise of the system. This issue has been addressed in commit `e17b80cff49` which is included in release version `1.4.3`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.05845 93rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed 1Panel (1Panel-dev): 1.4.3github.com/1Panel-dev/1Panel (Go): 1.4.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-dev1Panelbefore 1.4.31.4.3Patch availableCNA
—github.com/1Panel-dev/1Panel (Go)before 1.4.31.4.3Patch availableGHSA-p9xf-74xh-mhw5
  • 1Panel Vendor1Panel-dev Affected before 1.4.3 Fixed in 1.4.3 Patch available CNA
  • github.com/1Panel-dev/1Panel (Go) Vendor— Affected before 1.4.3 Fixed in 1.4.3 Patch available GHSA-p9xf-74xh-mhw5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*before 1.4.3Vulnerable1Panel-dev
  • cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* Versions before 1.4.3 Vulnerable ·1Panel-dev

Remediation

  • Fix · CNA 1Panel (1Panel-dev) Fixed in 1.4.3
  • Fix · GHSA-p9xf-74xh-mhw5 github.com/1Panel-dev/1Panel (Go) Fixed in 1.4.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-37477
  2. 2026-10-03 Alias added: GHSA-p9xf-74xh-mhw5

References

Exploit 1

Patch 1

Advisory 1

Other 2

  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
  • TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
  • TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
  • TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
  • TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
  • TI-2023-20857 1Panel O&M management panel has a background arbitrary file reading vulnerability CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences