What’s Vulnerable › Vulnerabilities

CVE-2025-34430: 1Panel CSRF Panel Name Modification

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-12-10 · updated 2026-10-14
• Weakness: CWE-352

Description

1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.

Affected products

• 1Panel-dev 1Panel: from 1.10.33-lts through 2.0.15

References

• https://1panel.pro/
• https://github.com/1Panel-dev/1Panel/releases
• https://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification

Get alerted when CVE-2025-34430 or the next vulnerability affects your stack