PT-2025-50368 · 1Panel · 1Panel

Av01T3X · Published 2025-12-10 · Updated 2026-01-06 · CVE-2025-34429

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions 1Panel versions 1.10.33 through 2.0.15

Description The software contains a cross-site request forgery (CSRF) issue in the web port configuration functionality. The port-change endpoint does not have CSRF protections, such as anti-CSRF tokens or Origin/Referer validation. An attacker can create a malicious webpage that submits a port-change request. If a user visits this webpage while logged in, their browser sends valid session cookies, allowing the request to succeed. This enables an attacker to modify the port the 1Panel web service uses, potentially disrupting service or causing a denial of service, and possibly exposing the service on a port selected by the attacker.

Recommendations Update 1Panel to a version later than 2.0.15.

Fix

DoS

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-34429

GHSA-WRVC-X3WF-J5F5

GO-2025-4231

SUSE-SU-2026:0037-1

Affected Products

1Panel

References · 85

• https://nvd.nist.gov/vuln/detail/CVE-2025-34429 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-34429 · Vendor Advisory
• https://github.com/1Panel-dev/1Panel/releases · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note
• https://suse.com/security/cve/CVE-2025-64702 · Note
• https://suse.com/security/cve/CVE-2025-64708 · Note
• https://suse.com/security/cve/CVE-2025-67499 · Note
• https://suse.com/security/cve/CVE-2025-13888 · Note