# CVE-2024-34352: 1Panel command injection in container log search API

Source: https://junglewise.ai/threats/cve-2024-34352-1panel-command-injection-in-container-log-search-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-09. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2024-34352 · Severity: medium · CVSS 6.5 · Published 2024-05-09

1Panel is an open-source Linux control panel used to manage server operations and Docker containers. A vulnerability in the container log search feature allows an attacker to write malicious files to the host server. This could lead to a complete takeover of the server, including the ability to execute commands with root privileges or modify sensitive system files like SSH keys.

Technologies: [1Panel-dev 1Panel](https://junglewise.ai/threats/technologies/1panel), [github.com/1Panel-dev/1Panel (Go)](https://junglewise.ai/threats/technologies/github-com-1panel-dev-1panel). Vendors: [1Panel-dev](https://junglewise.ai/threats/vendors/1panel-dev), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2024-34352 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-34352 being exploited in the wild.

**How severe is CVE-2024-34352?** Medium severity, with a CVSS score of 6.5, published 9 May 2024.

**Which products and versions are affected?** 1Panel-dev 1Panel < 1.10.3-lts; github.com/1Panel-dev/1Panel (Go) < 1.10.3-lts, SEMVER:introduced=0,fixed=1.10.3-lts.

**Is there a fix for CVE-2024-34352?** Yes. github.com/1Panel-dev/1Panel (Go): upgrade to 1.10.3-lts or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-34352 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2024-34352?** Check whether you run 1Panel-dev 1Panel or github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/1Panel-dev/1Panel (Go): upgrade to 1.10.3-lts or later

  ```sh
  go get github.com/1Panel-dev/1Panel@v1.10.3-lts
  ```


## Technical details

A command injection vulnerability exists in 1Panel's container log search functionality (specifically the `/api/v1/containers/search/log` endpoint). The application fails to properly sanitize the `container` parameter, allowing an attacker to use shell redirection operators (e.g., '>') to write arbitrary content to the host filesystem. By deploying a malicious Docker image that generates specific output and then triggering a log search with a redirected path, an attacker can create or overwrite files such as SSH authorized_keys or cron jobs. This exploit typically requires some user interaction or a specific environment state but can result in full remote code execution (RCE) as the application often runs with root privileges. The issue is addressed in version 1.10.3-lts.

## Affected products

- 1Panel-dev 1Panel < 1.10.3-lts

## Identifiers

- CVE-2024-34352
- GHSA-f8ch-w75v-c847
- GO-2024-2830

## Timeline

- 2024-05-09: disclosed
- 2024-05-09: advisory
- 2024-05-09: patched

## References

- [https://api.github.com/users/an5er](https://api.github.com/users/an5er)
- [https://github.com/an5er](https://github.com/an5er)
- [https://api.github.com/users/an5er/gists%7B/gist_id%7D](https://api.github.com/users/an5er/gists%7B/gist_id%7D)
- [https://api.github.com/users/an5er/repos](https://api.github.com/users/an5er/repos)
- [https://avatars.githubusercontent.com/u/95564938?v=4](https://avatars.githubusercontent.com/u/95564938?v=4)
- [https://api.github.com/users/an5er/events%7B/privacy%7D](https://api.github.com/users/an5er/events%7B/privacy%7D)

## Related threats

- [1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint](https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint)
- [1Panel-dev CordysCRM SSRF in TokenService via mkAddress](https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress)
- [1Panel-dev CordysCRM stored XSS in ModuleFormController](https://junglewise.ai/threats/cve-2026-10567-1panel-dev-cordyscrm-stored-xss-in-moduleformcontroller)
- [LXware 1Panel CSRF in panel name management](https://junglewise.ai/threats/cve-2025-34430-lxware-1panel-csrf-in-panel-name-management)
- [LXware 1Panel CSRF in web port configuration](https://junglewise.ai/threats/cve-2025-34429-lxware-1panel-csrf-in-web-port-configuration)