Read the docs
TI-2024-02187 Aliases CVE-2024-2352GHSA-x2vg-5wrf-vj6v

1Panel swap baseApi.UpdateDeviceSwap command injection

Priority HIGH 75CWE-77Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.

Summary

A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03044 87th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD and the CNA
Fix Fixed github.com/1Panel-dev/1Panel (Go): 1.10.1-lts

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—1Panel1.10.1-lts—No fix listedCNA
—github.com/1Panel-dev/1Panel (Go)before 1.10.1-lts1.10.1-ltsPatch availableGHSA-x2vg-5wrf-vj6v
  • 1Panel Vendor— Affected 1.10.1-lts Fixed in — No fix listed CNA
  • github.com/1Panel-dev/1Panel (Go) Vendor— Affected before 1.10.1-lts Fixed in 1.10.1-lts Patch available GHSA-x2vg-5wrf-vj6v

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*before 1.10.2-ltsVulnerable1Panel-dev
  • cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* Versions before 1.10.2-lts Vulnerable ·1Panel-dev

Remediation

  • Fix · GHSA-x2vg-5wrf-vj6v github.com/1Panel-dev/1Panel (Go) Fixed in 1.10.1-lts Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2352
  2. 2026-10-03 Alias added: GHSA-x2vg-5wrf-vj6v

References

Exploit 2

Patch 1

Advisory 1

Other 1

  • TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
  • TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
  • TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
  • TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
  • TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8
  • TI-2023-20857 1Panel O&M management panel has a background arbitrary file reading vulnerability CVSS 3.1HIGH 7.5
See all 20 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences