Executive brief
1Panel is an open-source control panel used to manage Linux servers, websites, and databases. A security flaw allows an attacker to trick an authenticated administrator into unknowingly changing the name of their management panel. While this does not directly expose sensitive data, it allows unauthorized modification of system settings if a logged-in user visits a malicious website.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in 1Panel versions 1.10.33 through 2.0.15 within the panel name management functionality. The affected endpoint lacks standard CSRF protections such as anti-CSRF tokens or Origin/Referer header validation. An unauthenticated remote attacker can exploit this by inducing an authenticated user to visit a specially crafted webpage. Upon visitation, the victim's browser will automatically submit a request to change the panel name using the victim's active session cookies. This results in unauthorized modification of the panel configuration. At the time of advisory publication, a formal patch from the maintainer had not been confirmed.
Affected products
- LXware 1Panel 1.10.33 - 2.0.15
Timeline
- 2025-12-10: disclosed: Initial disclosure by VulnCheck
- 2025-12-10: advisory: NVD entry published