1panel-dev 1panel vulnerabilities

• 1panel-dev 1panel 1panel App Store vulnerable to Cross-site Scripting CVE-2026-23525 6.4 MediumJanuary 18, 2026
• 1panel-dev 1panel 1Panel CSRF Web Port Configuration Change CVE-2025-34429 7.0 HighDecember 10, 2025
• 1panel-dev 1panel 1Panel CSRF Panel Name Modification CVE-2025-34430 5.1 MediumDecember 10, 2025
• 1panel-dev 1panel 1Panel CSRF in Change Username Functionality Allows Account Lockout CVE-2025-34410 7.0 HighDecember 10, 2025
• 1panel-dev 1panel 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers CVE-2025-66508 Fix available 6.5 MediumDecember 8, 2025
• 1panel-dev 1panel 1Panel – CAPTCHA Bypass via Client-Controlled Flag CVE-2025-66507 Fix available 7.5 HighDecember 8, 2025
• 1panel-dev 1panel 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution CVE-2025-54424 Public exploitFix available 8.1 HighAugust 1, 2025
• 1panel-dev 1panel 1Panel SQL injection CVE-2024-39911 Fix available 10.0 CriticalJuly 18, 2024
• 1panel-dev 1panel a sqlinjection in 1Panel CVE-2024-39907 Fix available EPSS 29.2% 9.8 CriticalJuly 18, 2024
• 1panel-dev 1panel Arbitrary file write vulnerability in 1Panel CVE-2024-34352 Fix available 6.5 MediumMay 9, 2024
• 1panel-dev 1panel 1Panel's password verification is suspected to have a timing attack vulnerability CVE-2024-30257 Fix available 3.9 LowApril 18, 2024
• 1panel-dev 1panel 1Panel swap baseApi.UpdateDeviceSwap command injection CVE-2024-2352 Fix available 6.3 MediumMarch 10, 2024
• 1panel-dev 1panel 1Panel open source panel project has an unauthorized vulnerability. CVE-2024-27288 Fix available 6.3 MediumMarch 6, 2024
• 1panel-dev 1panel 1Panel set-cookie is missing the Secure keyword CVE-2024-24768 Fix available 6.5 MediumFebruary 5, 2024
• 1panel-dev 1panel 1Panel arbitrary file write vulnerability exists in the background CVE-2023-39966 Fix available 7.5 HighAugust 10, 2023
• 1panel-dev 1panel 1Panel Unauthorized access in Backend CVE-2023-39965 Fix available 6.5 MediumAugust 10, 2023
• 1panel-dev 1panel 1Panel O&M management panel has a background arbitrary file reading vulnerability CVE-2023-39964 Fix available 7.5 HighAugust 10, 2023
• 1panel-dev 1panel Command injection in firewall ip functionality in 1Panel CVE-2023-37477 Fix available 7.2 HighJuly 18, 2023
• 1panel-dev 1panel 1Panel vulnerable to command injection when adding container repositories CVE-2023-36457 Fix available 6.3 MediumJuly 5, 2023
• 1panel-dev 1panel 1Panel vulnerable to ommand injection when entering the container terminal CVE-2023-36458 Fix available 6.3 MediumJuly 5, 2023