CVE-2024-34352: Arbitrary file write vulnerability in 1Panel

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-77

Description

1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.

Affected products

1Panel-dev 1Panel: before 1.10.3-lts — fixed in 1.10.3-lts

How to fix

Upgrade to a fixed version: 1Panel-dev 1Panel 1.10.3-lts. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-34352 or the next vulnerability affects your stack