Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

1Panel-dev — Vulnerabilities & Security Advisories 57

Browse all 57 CVE security advisories affecting 1Panel-dev. AI-powered Chinese analysis, POCs, and references for each vulnerability.

1Panel-dev is an open-source, modern Linux server management tool designed to simplify the deployment and management of web applications through a graphical interface. Its architecture integrates containerization technologies, allowing users to manage databases, proxies, and monitoring services efficiently. Historically, the platform has been associated with forty-four recorded Common Vulnerabilities and Exposures (CVEs), predominantly involving remote code execution, cross-site scripting, and privilege escalation flaws. These vulnerabilities often stem from insufficient input validation in API endpoints or improper access control mechanisms within the web interface. Notable incidents include critical RCE exploits that allowed unauthenticated attackers to gain full system control, highlighting risks inherent in complex management panels. While the project actively patches these issues, the high volume of past CVEs underscores the importance of rigorous security auditing for administrators relying on this tool for critical infrastructure management.

Top products by 1Panel-dev: MaxKB 1Panel CordysCRM KubePi
CVE ID Title CVSS Severity Published
CVE-2026-64870 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation — MaxKB CWE-918 5.3 Medium 2026-07-30
CVE-2026-16223 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery — CordysCRM CWE-918 6.3 Medium 2026-07-19
CVE-2026-16222 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery — CordysCRM CWE-918 6.3 Medium 2026-07-19
CVE-2026-54149 MaxKB MCP tool import validation bypass allows post-authentication remote code execution — MaxKB CWE-78 8.8 High 2026-07-10
CVE-2026-56779 MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters — MaxKB CWE-918 6.4 Medium 2026-06-25
CVE-2026-10567 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting — CordysCRM CWE-79 3.5 Low 2026-06-02
CVE-2026-10514 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting — CordysCRM CWE-79 2.4 Low 2026-06-01
CVE-2026-42336 MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch — MaxKB CWE-367 - - 2026-05-26
CVE-2026-42337 MaxKB: Broken Access Control in MaxKB OSS URL Fetch API — MaxKB CWE-862 - - 2026-05-26
CVE-2026-44847 MaxKB: Webhook Trigger Authentication Bypass — MaxKB CWE-287 7.5 High 2026-05-26
CVE-2026-45412 MaxKB: Unauthenticated SSRF via Workflow Template Import — MaxKB CWE-918 - - 2026-05-26
CVE-2026-45413 MaxKB: Unsalted MD5 Password Hashing — MaxKB CWE-328 - - 2026-05-26
CVE-2026-42335 MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy — MaxKB CWE-918 - - 2026-05-26
CVE-2026-39426 MaxKB: Stored XSS via Unsanitized iframe_render Parsing — MaxKB CWE-79 5.4 - 2026-04-14
CVE-2026-39425 MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering — MaxKB CWE-80 5.4 - 2026-04-14
CVE-2026-39419 MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing — MaxKB CWE-74 3.1 Low 2026-04-14
CVE-2026-39424 MaxKB has CSV Injection in its Application Chat Export Functionality — MaxKB CWE-1236 7.8 - 2026-04-14
CVE-2026-39423 Stored XSS via Eval Injection in EchartsRander Component — MaxKB CWE-79 5.4 - 2026-04-14
CVE-2026-39422 MaxKB has Stored XSS via ChatHeadersMiddleware — MaxKB CWE-79 5.4 - 2026-04-14
CVE-2026-39421 MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect — MaxKB CWE-693 6.3 Medium 2026-04-14
CVE-2026-39420 MaxKB: Sandbox escape via LD_PRELOAD bypass — MaxKB CWE-693 6.3 Medium 2026-04-14
CVE-2026-39418 MaxKB: SSRF via sandbox network hook bypass — MaxKB CWE-918 5.0 Medium 2026-04-14
CVE-2026-39417 MaxKB: RCE via MCP stdio command injection in workflow engine — MaxKB CWE-78 4.6 Medium 2026-04-14
CVE-2025-15632 1Panel-dev MaxKB MdPreview chat.ts cross site scripting — MaxKB CWE-79 3.5 Low 2026-04-13
CVE-2026-6108 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection — MaxKB CWE-78 6.3 Medium 2026-04-12
CVE-2026-6107 1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting — MaxKB CWE-79 3.5 Low 2026-04-12
CVE-2026-6106 1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting — MaxKB CWE-79 3.5 Low 2026-04-11
CVE-2026-23525 1panel App Store vulnerable to Cross-site Scripting — 1Panel CWE-79 6.4 Medium 2026-01-18
CVE-2025-66446 MaxKB has a Python sandbox LD_PRELOAD bypass — MaxKB CWE-362 8.8 High 2025-12-11
CVE-2025-66419 MaxKB vulnerable to privilege escalation through sandbox bypass — MaxKB CWE-362 8.8 High 2025-12-11

This page lists every published CVE security advisory associated with 1Panel-dev. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.