https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T19:00:50.374418+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-192789 EUVD-2026-192789 2026-10-03T19:00:50.438960+00:00 EUVD-2026-192789 https://cve.radiocsirt.org/vuln/fkie_cve-2023-39965 fkie_cve-2023-39965 2026-10-03T19:00:50.439007+00:00

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.

 https://cve.radiocsirt.org/vuln/ghsa-85cf-gj29-f555 GHSA-85cf-gj29-f555 — 1Panel Arbitrary File Download vulnerability 2026-10-03T19:00:50.439044+00:00

Affected: Go: github.com/1Panel-dev/1Panel

### Summary Any file downloading vulnerability exists in 1Panel backend.

### Details Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. ![image](https://user-images.githubusercontent.com/116613486/257246024-d0e35800-5fd8-4907-8b1b-504afaad859e.png)

### PoC payload:

POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json

{"path":"/etc/passwd"}

![f77959349e96543436eea18283fa75c](https://user-images.githubusercontent.com/116613486/257245459-13f2f31b-fcfe-4a27-ba52-e2f1e5d4d749.png)

### Impact Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.

 https://cve.radiocsirt.org/vuln/gsd-2023-39965 gsd-2023-39965 2026-10-03T19:00:50.439078+00:00 gsd-2023-39965