---
id: CVE-2025-66508
title: '1Panel is an open-source, web-based control panel for Linux server management'
summary: >-
  1Panel is an open-source, web-based control panel for Linux server management.
  Versions 2.0.14 and below use Gin's default configuration which trusts all IP
  addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to
  spoof …
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-290
vendor: fit2cloud
product: 1panel
affected:
  - 1panel < 2.0.14
patched:
  - 1panel 2.0.14
published: '2025-12-09'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T21:10:00.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66508'
references:
  - url: >-
      https://github.com/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed
    label: security-advisories@github.com
  - url: >-
      https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.00253
epssPercentile: 0.15642
ingestedAt: '2026-10-14T21:57:04.742Z'
---

## Overview

1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For:  127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.

## Affected

- `1panel < 2.0.14`

## Remediation

Upgrade past the affected range:

- `1panel 2.0.14`