https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 04:33:05 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-192788 EUVD-2026-192788 https://cve.radiocsirt.org/vuln/euvd-2026-192788 https://cve.radiocsirt.org/vuln/fkie_cve-2023-39966 <p>1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.</p> <p>1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations. Version 1.5.0 contains a patch for this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-39966 https://cve.radiocsirt.org/vuln/ghsa-hf7j-xj3w-87g4 <p><strong>Affected:</strong> Go: github.com/1Panel-dev/1Panel</p> <p># Summary An arbitrary file write vulnerability could lead to direct control of the server # Details ## Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:</p> <p>- Vulnerable Code</p> <p></p> <p># PoC</p> <p>- We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.</p> <p></p> <p>- The server was successfully written to the public key </p> <p>- Successfully connected to the target server using an SSH private key.  </p> <p>As a result, the server is directly controlled, causing serious **harm**</p> <p># Impact 1Panel v1.4.3</p> <p><strong>Affected:</strong> Go: github.com/1Panel-dev/1Panel</p> <p># Summary An arbitrary file write vulnerability could lead to direct control of the server # Details ## Arbitrary file creation In the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:</p> <p>- Vulnerable Code</p> <p></p> <p># PoC</p> <p>- We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.</p> <p></p> <p>- The server was successfully written to the public key </p> <p>- Successfully connected to the target server using an SSH private key.  </p> <p>As a result, the server is directly controlled, causing serious **harm**</p> <p># Impact 1Panel v1.4.3</p> https://cve.radiocsirt.org/vuln/ghsa-hf7j-xj3w-87g4 https://cve.radiocsirt.org/vuln/gsd-2023-39966 gsd-2023-39966 https://cve.radiocsirt.org/vuln/gsd-2023-39966