CVE-2023-39964

Katalog CVE

CVSS 7.5 · High EPSS 0,97%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada fit2cloud 1panel. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary important configuration files on the server. In the `api/v1/file.go` file, there is a function called `LoadFromFile`, which directly reads the file by obtaining the requested path `parameter[path]`. The request parameters are not filtered, resulting in a background arbitrary file reading vulnerability. Version 1.5.0 has a patch for this issue.

Rincian

Terbit di NVD

10 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

0,97% peluang dieksploitasi; lebih tinggi dari 60,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-pv7q-v9mv-9mh5 exploit · advisory vendor
• https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0 product · release notes