Critical severity · published Jul 18, 2024
CVE-2024-39907
a sqlinjection in 1Panel
9.8
CVSS
29.2%
EPSS
No
On KEV
Description
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)29.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1P
1Panel · 1Panel-dev
>= 1.10.9-tls, < 1.10.12-tls · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39907
Exploit
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
More from 1Panel
9.8
CVE-2025-54424
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
9.8
CVE-2024-39911
1Panel SQL injection
9.8
CVE-2023-39966
1Panel arbitrary file write vulnerability exists in the background
8.8
CVE-2023-37477
Command injection in firewall ip functionality in 1Panel
8.8
CVE-2023-36457
1Panel vulnerable to command injection when adding container repositories