Critical severity · published Jul 18, 2024
CVE-2024-39907
1Panel is a web-based linux server management control panel
9.8
CVSS
29.2%
EPSS
No
On KEV
Description
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)29.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
1P
1panel · Fit2cloud
1.10.9-lts before 1.10.12-lts · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39907
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39907
Exploit
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-5grx-v727-qmq6
More from 1panel
9.8
CVE-2025-54424
1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution
9.8
CVE-2024-39911
1Panel is a web-based linux server management control panel
9.8
CVE-2024-2352
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts
9.8
CVE-2023-39966
1Panel is an open source Linux server operation and maintenance management panel
8.8
CVE-2025-56413
OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the…