Read the docs
TI-2023-20859 Aliases CVE-2023-39966GHSA-hf7j-xj3w-87g4

1Panel arbitrary file write vulnerability exists in the background

Priority HIGH 81CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00834 57th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/1Panel-dev/1Panel (Go): 1.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-dev1Panel= 1.4.3—No fix listedCNA
—github.com/1Panel-dev/1Panel (Go)1.4.3 to before 1.5.01.5.0Patch availableGHSA-hf7j-xj3w-87g4
  • 1Panel Vendor1Panel-dev Affected = 1.4.3 Fixed in — No fix listed CNA
  • github.com/1Panel-dev/1Panel (Go) Vendor— Affected 1.4.3 to before 1.5.0 Fixed in 1.5.0 Patch available GHSA-hf7j-xj3w-87g4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:1panel:1.4.3:*:*:*:*:*:*:*1.4.3Vulnerable1Panel-dev
  • cpe:2.3:a:fit2cloud:1panel:1.4.3:*:*:*:*:*:*:* Versions 1.4.3 Vulnerable ·1Panel-dev

Remediation

  • Fix · GHSA-hf7j-xj3w-87g4 github.com/1Panel-dev/1Panel (Go) Fixed in 1.5.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39966
  2. 2026-10-03 Alias added: GHSA-hf7j-xj3w-87g4

References

Exploit 1

Advisory 1

Other 2

  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
  • TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
  • TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
  • TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
  • TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8
  • TI-2023-20857 1Panel O&M management panel has a background arbitrary file reading vulnerability CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences