{"id":"CVE-2023-39966","aliases":["GHSA-hf7j-xj3w-87g4","GO-2023-2006"],"url":"https://o3.security/vulnerability/CVE-2023-39966","summary":"1Panel arbitrary file write vulnerability exists in the background","details":"# Summary\nAn arbitrary file write vulnerability could lead to direct control of the server\n# Details\n## Arbitrary file creation\nIn the api/v1/file.go file, there is a function called SaveContentthat,It recieves JSON data sent by users in the form of a POST request. And the lack of parameter filtering allows for arbitrary file write operations.It looks like this:\n\n- Vulnerable Code\n\n![微信图片_20230801092544](https://user-images.githubusercontent.com/136411443/257381095-4d7c014b-b699-4152-8b9d-2cc9399dfd85.png)\n\n# PoC\n\n- We can write the SSH public key into the /etc/.root/authorized_keys configuration file on the server.\n\n![微信图片_20230801093243](https://user-images.githubusercontent.com/136411443/257381907-38784fab-77b9-47b9-a598-44ef7ad0b65c.png)\n\n- The server was successfully written to the public key\n![微信图片_20230801093610](https://user-images.githubusercontent.com/136411443/257382468-b4836eee-f751-4b43-93ff-cb39fdc6c809.png)\n\n- Successfully connected to the target server using an SSH private key.\n![微信图片_20230801093933](https://user-images.githubusercontent.com/136411443/257383031-53f1e5de-2743-48ed-a1cf-9a5ea0c0f90b.png)\n![微信图片_20230801094037](https://user-images.githubusercontent.com/136411443/257383041-d9f64647-95d9-4711-8b9f-e152966537c9.png)\n\nAs a result, the server is directly controlled, causing serious **harm**\n\n\n# Impact\n1Panel v1.4.3\n","published":"2023-08-10T17:46:21.104Z","modified":"2026-08-12T03:51:31.025626619Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"github.com/1Panel-dev/1Panel","fixedVersion":"1.5.0"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/1Panel-dev/1Panel/releases/tag/v1.5.0"},{"type":"ADVISORY","url":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-hf7j-xj3w-87g4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39966.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39966"},{"type":"PACKAGE","url":"https://github.com/1Panel-dev/1Panel"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:31.025626619Z"}}