CVE-2025-54424
Description
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate validation, leading to unauthorized interface access. Due to the presence of numerous command execution or high-privilege interfaces in 1Panel, this results in Remote Code Execution (RCE). This is fixed in version 2.0.6. The CVE has been translated from Simplified Chinese using GitHub Copilot.
How to fix
- fit2cloud 1panel2.0.6 or later
- github.com/1Panel-dev/1Panel/core2.0.6, 0.0.0-20250730021757-04b9cbd87a15 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fit2cloud 1panel | v < 2.0.6 | 2.0.6 |
| github.com/1Panel-dev/1Panel/coreGo | 1.0.0 ≤ v < 2.0.6, v < 0.0.0-20250730021757-04b9cbd87a15, No range specified | 2.0.6, 0.0.0-20250730021757-04b9cbd87a15 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.