CVE-2024-39907 a sqlinjection in 1Panel

What is CVE-2024-39907?

CVE-2024-39907 is a critical SQL injection vulnerability in 1Panel-dev 1Panel, published on 18 Jul 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in version 1.10.12-tls. Users are advised to upgrade. There are no known workarounds for these issues.

Weakness: CWE-89

Which versions are affected by CVE-2024-39907?

3 open source packages ship an affected version, including github.com/1Panel-dev/1Panel. It affects 1 product.

Products include Fit2cloud 1panel.

How do I fix CVE-2024-39907?

Upgrade github.com/1Panel-dev/1Panel to 1.10.12-tls or later.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2024-39907 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39907 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in 1Panel-dev 1Panel

• CVE-2024-39911 1Panel SQL injection Critical 10.0
• CVE-2025-56413 Command injection in n/a High 8.8
• CVE-2025-54424 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution High 8.1
• CVE-2025-66507 1Panel – CAPTCHA Bypass via Client-Controlled Flag High 7.5
• CVE-2023-39964 1Panel O&M management panel has a background arbitrary file reading vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5grx-v727-qmq6, GO-2024-2990.