High severity · published May 9, 2024
CVE-2024-34352
Arbitrary file write vulnerability in 1Panel
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1P
1Panel · 1Panel-dev
<= v1.10.2-lts · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-34352
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-34352
Exploit
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-f8ch-w75v-c847
More from 1Panel
9.8
CVE-2025-54424
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
9.8
CVE-2024-39911
1Panel SQL injection
9.8
CVE-2024-39907
a sqlinjection in 1Panel
8.4
CVE-2026-23525
1panel App Store vulnerable to Cross-site Scripting
7.5
CVE-2025-66507
1Panel – CAPTCHA Bypass via Client-Controlled Flag