Read the docs
TI-2023-20857 Aliases CVE-2023-39964GHSA-pv7q-v9mv-9mh5

1Panel O&M management panel has a background arbitrary file reading vulnerability

Priority HIGH 72CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00972 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/1Panel-dev/1Panel (Go): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-dev1Panel= 1.4.3—No fix listedCNA
—github.com/1Panel-dev/1Panel (Go)1.4.3 to before 1.5.01.5.0Patch availableGHSA-pv7q-v9mv-9mh5
  • 1Panel Vendor1Panel-dev Affected = 1.4.3 Fixed in — No fix listed CNA
  • github.com/1Panel-dev/1Panel (Go) Vendor— Affected 1.4.3 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-pv7q-v9mv-9mh5

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:1panel:1.4.3:*:*:*:*:*:*:*1.4.3Vulnerable1Panel-dev
  • cpe:2.3:a:fit2cloud:1panel:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·1Panel-dev

Remediation

  • Fix · GHSA-pv7q-v9mv-9mh5 github.com/1Panel-dev/1Panel (Go) Fixed in 1.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39964
  2. 2026-10-03 Alias added: GHSA-pv7q-v9mv-9mh5

References

Exploit 1

Advisory 1

Other 2

  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
  • TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
  • TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
  • TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
  • TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
  • TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences