Skip to content
OpenAdvisories
High · 7.5 CVE-2023-39966 EUVD-2023-2301GHSA-hf7j-xj3w-87g4GO-2023-2006

1Panel arbitrary file write vulnerability exists in the background

Published Aug 10, 2023 · Updated Oct 4, 2024 · Assigned by GitHub_M

Description

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.

Affected products

VendorProductAffectedFixed
1Panel-dev 1Panel = 1.4.3 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0 1.5.0 GHSA-hf7j-xj3w-87g4

References