1Panel 漏洞列表

1Panel后台存在任意文件读取漏洞，攻击者通过漏洞可以获取服务器中的敏感信息文件

1Panel 是一款开源的 Linux 服务器管理工具，通过 Web 界面简化运维管理流程，支持域名绑定、SSL 配置、容器管理、安全审计等功能。 2025年8月，1Panel官方发布v2.0.6版本修复了1Panel专业版的agent证书验证绕过导致的任意命令执行漏洞。该漏洞允许未授权攻击者绕过身份验证访问高权限接口在服务器上执行任意命令。经验证，非专业版和未启用从节点的用户不受此漏洞影响，本次漏洞仅影响1Panel专业版<=v.2.0.5且添加了从节点的1Panel，建议受影响的用户及时更新版本进行修复。

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.