---
id: CVE-2025-34430
title: >-
  1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery
  (CSRF) vulnerability in the panel name management functionality
summary: >-
  1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery
  (CSRF) vulnerability in the panel name management functionality. The affected
  endpoint does not implement CSRF defenses such as anti-CSRF tokens or
  Origin/Refere…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'
cwe:
  - CWE-352
vendor: fit2cloud
product: 1panel
affected:
  - '1panel >= 1.10.33-lts, <= 2.0.15'
published: '2025-12-10'
updated: '2026-07-14'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-34430'
references:
  - url: 'https://1panel.pro/'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/1Panel-dev/1Panel/releases'
    label: disclosure@vulncheck.com
  - url: 'https://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification'
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00211
epssPercentile: 0.10276
ingestedAt: '2026-07-15T13:44:03.602Z'
---

## Overview

1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.

## Affected

- `1panel >= 1.10.33-lts, <= 2.0.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.