PT-2025-37052
CVE-2025-56413
·
Published
2025-09-10
·
Updated
2025-11-18
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions:
1panel version 2.0.8
Description:
An OS Command injection issue exists in the
OperateSSH function within 1panel. Attackers can execute arbitrary commands by manipulating the operation parameter of the /api/v2/hosts/ssh/operate API endpoint.Recommendations:
As a temporary workaround, restrict access to the
/api/v2/hosts/ssh/operate API endpoint to minimize the risk of exploitation.
Consider disabling the OperateSSH function until a patch is available.Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾