CVE-2024-2352 1Panel swap baseApi.UpdateDeviceSwap command injection

What is CVE-2024-2352?

CVE-2024-2352 is a medium-severity command injection vulnerability in 1Panel, published on 10 Mar 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-256304.

Weakness: CWE-77

Which versions are affected by CVE-2024-2352?

3 open source packages ship an affected version, including github.com/1Panel-dev/1Panel. It affects 1 product.

Products include Fit2cloud 1panel.

How do I fix CVE-2024-2352?

Upgrade github.com/1Panel-dev/1Panel to 1.10.1-lts or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-2352 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2352 exists.

Other vulnerabilities in 1Panel

• CVE-2024-39911 1Panel SQL injection Critical 10.0
• CVE-2024-39907 a sqlinjection in 1Panel Critical 9.8
• CVE-2025-56413 Command injection in n/a High 8.8
• CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution High 8.1
• CVE-2025-66507 1Panel – CAPTCHA Bypass via Client-Controlled Flag High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x2vg-5wrf-vj6v, GO-2024-2636.