Medium severity · published Aug 10, 2023
CVE-2023-39965
1Panel is an open source Linux server operation and maintenance management panel
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access. Attackers can freely download the file content on the target system. This may cause a large amount of information leakage. Version 1.5.0 has a patch for this issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1P
1panel · Fit2cloud
1.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-39965
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-39965
Product
https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0
Exploit
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-85cf-gj29-f555
More from 1panel
9.8
CVE-2025-54424
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
9.8
CVE-2024-39911
1Panel SQL injection
9.8
CVE-2024-39907
a sqlinjection in 1Panel
9.8
CVE-2024-2352
1Panel swap baseApi.UpdateDeviceSwap command injection
9.8
CVE-2023-39966
1Panel is an open source Linux server operation and maintenance management panel