CVE-2024-34352 Arbitrary file write vulnerability in 1Panel

What is CVE-2024-34352?

CVE-2024-34352 is a medium-severity command injection vulnerability in 1Panel-dev 1Panel, published on 9 May 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol `>` can be used to achieve arbitrary file writing. This vulnerability is fixed in v1.10.3-lts.

Weakness: CWE-77

Which versions are affected by CVE-2024-34352?

3 open source packages ship an affected version, including github.com/1Panel-dev/1Panel. It affects 1 product.

Products include Fit2cloud 1panel.

How do I fix CVE-2024-34352?

Upgrade github.com/1Panel-dev/1Panel to 1.10.3-lts or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2024-34352 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-34352 exists.

Other vulnerabilities in 1Panel-dev 1Panel

• CVE-2024-39911 1Panel SQL injection Critical 10.0
• CVE-2024-39907 a sqlinjection in 1Panel Critical 9.8
• CVE-2025-56413 Command injection in n/a High 8.8
• CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution High 8.1
• CVE-2025-66507 1Panel – CAPTCHA Bypass via Client-Controlled Flag High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-f8ch-w75v-c847, GO-2024-2830.