CVE-2023-36457: 1Panel vulnerable to command injection when adding container repositories

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-05 · updated 2026-06-17
Weakness: CWE-77

Description

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.

Affected products

1Panel-dev 1Panel: before 1.3.6 — fixed in 1.3.6

How to fix

Upgrade to a fixed version: 1Panel-dev 1Panel 1.3.6. Check the vendor advisory for mitigations.

References

https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x
https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8x

Get alerted when CVE-2023-36457 or the next vulnerability affects your stack