RCE in 1panel-Dev 1panel
CVE-2025-54424
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate validation, leading to unauthorized interface access. Due to the presence of numerous command execution or high-privilege interfaces in 1Panel, this results in Remote Code Execution (RCE). This is fixed in version 2.0.6. The CVE has been translated from Simplified Chinese using GitHub Copilot.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.009 (57.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- 1panel-dev 1panel — versions < 2.0.6
- Fit2cloud 1panel
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Exploit, Third Party Advisory)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (x_refsource_MISC, Release Notes)
Frequently asked questions
- What is CVE-2025-54424?
- CVE-2025-54424 is a high-severity vulnerability in 1panel-Dev 1panel, classified under Command Injection. CVSS score: 8.1/10. Published 2025-08-01.
- How severe is CVE-2025-54424?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2025-54424 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.