1Panel SQL injection
Priority MEDIUM 56CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.
Summary
1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.04528 91st percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed 1Panel (1Panel-dev): 1.10.12-lts
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| 1Panel-dev | 1Panel | before 1.10.12-lts | 1.10.12-lts | Patch available | CNA |
- 1Panel Vendor1Panel-dev Affected before 1.10.12-lts Fixed in 1.10.12-lts Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* | 1.10.10-lts to before 1.10.12-lts | Vulnerable | 1Panel-dev |
- cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:* Versions 1.10.10-lts to before 1.10.12-lts Vulnerable ·1Panel-dev
Remediation
- Fix · CNA 1Panel (1Panel-dev) Fixed in 1.10.12-lts
Timeline
- 2026-10-02 Threatist record created from CVE-2024-39911
References
More 1Panel-dev 1panel vulnerabilities
- TI-2024-26801 a sqlinjection in 1Panel CVSS 3.1CRITICAL 9.8
- TI-2023-20859 1Panel arbitrary file write vulnerability exists in the background CVSS 3.1CRITICAL 9.8
- TI-2025-34229 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVSS 3.1CRITICAL 9.8
- TI-2024-02187 1Panel swap baseApi.UpdateDeviceSwap command injection CVSS 3.1CRITICAL 9.8
- TI-2025-35333 OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing… CVSS 3.1HIGH 8.8
- TI-2023-19085 Command injection in firewall ip functionality in 1Panel CVSS 3.1HIGH 8.8
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences