CVE-2023-39964

HIGH EXPLOITED

1Panel 1.4.3-<1.5.0 - Arbitrary File Read via Unfiltered Path Parameter

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2023-39964 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.

References (2)

Core 2
Core References
Product, Release Notes x_refsource_misc
https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0

Scores

CVSS v3 7.5
EPSS 0.0082
EPSS Percentile 52.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2026-04-06
CWE
CWE-22
Status published
Products (2)
1Panel-dev/1Panel 1.4.3 - 1.5.0Go
fit2cloud/1panel 1.4.3
Published Aug 10, 2023
Tracked Since Feb 18, 2026