Arbitrary file write vulnerability in 1Panel
Priority HIGH 68CWE-77Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-77.
Summary
1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01329 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed github.com/1Panel-dev/1Panel (Go): 1.10.3-lts
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| 1Panel-dev | 1Panel | up to v1.10.2-lts | — | No fix listed | CNA |
| — | github.com/1Panel-dev/1Panel (Go) | before 1.10.3-lts | 1.10.3-lts | Patch available | GHSA-f8ch-w75v-c847 |
- 1Panel Vendor1Panel-dev Affected up to v1.10.2-lts Fixed in — No fix listed CNA
- github.com/1Panel-dev/1Panel (Go) Vendor— Affected before 1.10.3-lts Fixed in 1.10.3-lts Patch available GHSA-f8ch-w75v-c847
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* | before 1.10.3-lts | Vulnerable | 1Panel-dev |
- cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* Versions before 1.10.3-lts Vulnerable ·1Panel-dev
Remediation
- Fix · GHSA-f8ch-w75v-c847 github.com/1Panel-dev/1Panel (Go) Fixed in 1.10.3-lts Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-34352
- 2026-10-03 Alias added: GHSA-f8ch-w75v-c847
References
More 1Panel-dev 1panel vulnerabilities
- TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
- TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
- TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
- TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
- TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
- TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8
Sources
- CVE-2024-34352 · CVE Program
- CVE-2024-34352 · NVD
- FIRST EPSS
- GHSA-f8ch-w75v-c847 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences