# CVE-2025-34430: LXware 1Panel CSRF in panel name management

Source: https://junglewise.ai/threats/cve-2025-34430-lxware-1panel-csrf-in-panel-name-management  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-12-10. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-34430 · Severity: medium · CVSS 4.3 · Published 2025-12-10

1Panel is an open-source control panel used to manage Linux servers, websites, and databases. A security flaw allows an attacker to trick an authenticated administrator into unknowingly changing the name of their management panel. While this does not directly expose sensitive data, it allows unauthorized modification of system settings if a logged-in user visits a malicious website.

Technologies: [github.com/1Panel-dev/1Panel (Go)](https://junglewise.ai/threats/technologies/github-com-1panel-dev-1panel). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-34430 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-34430 being exploited in the wild.

**How severe is CVE-2025-34430?** Medium severity, with a CVSS score of 4.3, published 10 December 2025.

**Which products and versions are affected?** github.com/1Panel-dev/1Panel (Go) SEMVER:introduced=0, SEMVER:introduced=1.10.33,last_affected=2.0.15.

**Is there a fix for CVE-2025-34430?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-34430 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2025-34430?** Check whether you run github.com/1Panel-dev/1Panel (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in 1Panel versions 1.10.33 through 2.0.15 within the panel name management functionality. The affected endpoint lacks standard CSRF protections such as anti-CSRF tokens or Origin/Referer header validation. An unauthenticated remote attacker can exploit this by inducing an authenticated user to visit a specially crafted webpage. Upon visitation, the victim's browser will automatically submit a request to change the panel name using the victim's active session cookies. This results in unauthorized modification of the panel configuration. At the time of advisory publication, a formal patch from the maintainer had not been confirmed.

## Affected products

- LXware 1Panel 1.10.33 - 2.0.15

## Identifiers

- CVE-2025-34430
- GHSA-5xpq-2vmc-5cqp
- GO-2025-4230

## Timeline

- 2025-12-10: disclosed: Initial disclosure by VulnCheck
- 2025-12-10: advisory: NVD entry published

## References

- [https://1panel.pro/](https://1panel.pro/)
- [https://github.com/1Panel-dev/1Panel/releases](https://github.com/1Panel-dev/1Panel/releases)
- [https://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification](https://www.vulncheck.com/advisories/1panel-csrf-panel-name-modification)

## Related threats

- [LXware 1Panel CSRF in web port configuration](https://junglewise.ai/threats/cve-2025-34429-lxware-1panel-csrf-in-web-port-configuration)
- [LXware 1Panel CSRF in Change Username functionality](https://junglewise.ai/threats/cve-2025-34410-lxware-1panel-csrf-in-change-username-functionality)
- [GO-2025-4207 - 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers in github.com/1Panel-dev/1Panel](https://junglewise.ai/threats/cve-2025-66508-1panel-ip-access-control-bypass-via-untrusted-x-forwarded-for)
- [GO-2025-4209 - 1Panel , CAPTCHA Bypass via Client-Controlled Flag in github.com/1Panel-dev/1Panel](https://junglewise.ai/threats/cve-2025-66507-1panel-captcha-bypass-via-client-controlled-flag)
- [GO-2023-2006 - 1Panel arbitrary file write vulnerability in github.com/1Panel-dev/1Panel](https://junglewise.ai/threats/cve-2023-39966-1panel-arbitrary-file-write-vulnerability)