PT-2026-94044 · Unknown · Pelican Panel
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Pelican Panel versions prior to 1.0.0-beta35
Description
Startup write permissions are enforced only through disabled form controls instead of server-side authorization checks. An attacker with
startup.read permission can craft Livewire state updates to trigger afterStateUpdated callbacks. This allows the modification of startup commands, docker images, and variables, leading to arbitrary command execution within the container.Recommendations
Update to version 1.0.0-beta35 or later.
Exploit
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Pelican Panel