CVE-2023-39965Medium· 6.5▾ Sunlit1Panel Arbitrary File Download vulnerability
1Panel Arbitrary File Download vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
Depth score36/ 100 · Low
impact 35.8 · likelihood 0.1 · exploitation 0
Proof of concept
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Published
Aug 10, 2023
Updated
Sep 10, 2026
CVSS
6.5
Vendor
1Panel-dev
Product
github.com/1Panel-dev/1Panel
CWE
—
Depth score
36 · Low
EPSS
0.44% · p38
Platforms
—
Source
OSV
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
EPSS history
Exploit-prediction probability, daily snapshots since Sep 12.
Timeline
Disclosure to exploitation, from the record and what we observed since indexing it.
- Published
Disclosed via OSV
- Record revised
Last analysed / modified upstream
- EPSS first tracked
0.4%
Affected
- github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0
Patched in
- github.com/1Panel-dev/1Panel 1.5.0
Full technical detail▾
Overview
Summary
Any file downloading vulnerability exists in 1Panel backend.
Details
Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.
PoC
payload:
POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json
{"path":"/etc/passwd"}
Impact
Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.
Affected packages
github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0
Remediation
Upgrade to a patched release:
github.com/1Panel-dev/1Panel 1.5.0
References
Related vulnerabilities
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-36458Medium· 6.31Panel vulnerable to command injection when entering the container terminal
same productshared advisory#osvCVE-2024-30257Medium· 5.91Panel's password verification is suspected to have a timing attack vulnerability
same productshared advisory#osvCVE-2024-39907Critical· 9.81Panel has an SQL injection issue related to the orderBy clause
same productshared advisory#osvCVE-2024-27288Medium· 6.31Panel open source panel project has an unauthorized vulnerability.
same productshared advisory#osvCVE-2026-108705Medium· 4.3CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId
same vendorCVE-2026-108704Medium· 4.3CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by setting the owner field to their own user id
same vendor
#osv#go