github.com
https://github.com/1Panel-dev/1Panel CVE-2023-39964
HIGH
1Panel O&M management panel has a background arbitrary file reading vulnerability
Record summary
CVE-2023-39964 has a selected CVSS score of 7.5 (high).
Description
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Apr 6, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 4, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
| CVE List | = 1.4.3 | affected | |
Default status: unknown | CVE List, VulnCheck | 1.4.3 | affected |
github.com/1Panel-dev/1PanelBrowse Go / github.com/1Panel-dev/1Panel | GitHub Advisory | 1.4.3 | affected |
| 1.4.3 to < 1.5.0 · Fixed in 1.5.0 | affected |
References
4github.com
https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0 github.comConfirmation
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-pv7q-v9mv-9mh5 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2023-39964