CVE-2023-36458: 1Panel vulnerable to ommand injection when entering the container terminal

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-05 · updated 2026-06-17
Weakness: CWE-77

Description

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payloads to achieve command injection when entering the container terminal. The vulnerability has been fixed in v1.3.6.

Affected products

1Panel-dev 1Panel: before 1.3.6 — fixed in 1.3.6

How to fix

Upgrade to a fixed version: 1Panel-dev 1Panel 1.3.6. Check the vendor advisory for mitigations.

References

https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7x2c-fgx6-xf9h
https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7x2c-fgx6-xf9h

Get alerted when CVE-2023-36458 or the next vulnerability affects your stack