CVE-2024-34352: Arbitrary file write vulnerability in 1Panel
Vulnerability summary
CVE-2024-34352 is a high (CVSS 7.5) vulnerability in 1panel-dev 1panel. EPSS estimates a 1.33% chance of exploitation in the next 30 days, higher than 71% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 6.5, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 09-05-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NDiffers
EPSS trend
Probability
1.33%
Chance of exploitation in the next 30 days
Percentile
71%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 found1Panel
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
1panel-dev1 product
- 1panel≤ v1.10.2-lts
Fit2cloud1 product
- 1panel< 1.10.3-lts
Github.com/1Panel-dev1 product
- 1Panel< 1.10.3-lts
3 vendors · 3 products
References
5 links- github.com/1Panel-dev/1Panel/security/advisories/GHSA-f8ch-w75v-c847X Refsource CONFIRMWEBAdvisoryExploitVendor Advisory
- github.com/1Panel-dev/1PanelPACKAGE