CVE-2024-39911: 1Panel SQL injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-07-18 · updated 2026-06-17
Weakness: CWE-89

Description

1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Affected products

1Panel-dev 1Panel: from 1.10.10-lts before 1.10.12-lts — fixed in 1.10.12-lts

How to fix

Upgrade to a fixed version: 1Panel-dev 1Panel 1.10.12-lts. Check the vendor advisory for mitigations.

References

https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5
https://blog.mo60.cn/index.php/archives/1Panel_SQLinjection2Rce.html
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7m53-pwp6-v3f5

Get alerted when CVE-2024-39911 or the next vulnerability affects your stack