1Panel CVE-2025-34430

Q: What is the CVSS score of CVE-2025-34430?

CVE-2025-34430 has a CVSS 4.0 base score of 5.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-12-10 disclosure@vulncheck.com

CSRF 1panel

5.1

CVSS 4.0 · Vendor: vulncheck

Severity by source

Vendor (vulncheck) PRIMARY

5.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

AV:N and PR:N because the attacker needs no server access; UI:R because victim must visit a malicious page; I:L for panel name modification only with no confidentiality or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (vulncheck).

CVSS VectorVendor: vulncheck

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 23:34 vuln.today

DescriptionCVE.org

1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.

AnalysisAI

Cross-site request forgery in 1Panel versions 1.10.33 through 2.0.15 allows a remote attacker to change an authenticated user's panel name by luring them to a malicious webpage. The panel name management endpoint omits both anti-CSRF tokens and Origin/Referer header validation, so the victim's browser automatically includes valid session cookies when the forged request fires. No public exploit code and no CISA KEV listing exist at time of analysis; real-world impact is limited to low-integrity panel configuration tampering.

Technical ContextAI

1Panel is a web-based Linux server management interface developed by fit2cloud (CPE: cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*). The CSRF flaw (CWE-352) arises because the panel name change endpoint performs a state-modifying action using session-cookie authentication without any synchronizer token, SameSite cookie attribute enforcement, or HTTP Origin/Referer validation. Browsers automatically attach cookies to cross-origin form submissions, meaning any attacker-controlled page can silently trigger the endpoint on behalf of a logged-in victim. The missing CSRF defenses are a server-side design gap, not a client-side weakness.

RemediationAI

Upgrade 1Panel to a version beyond 2.0.15 once a patched release is published; monitor https://github.com/1Panel-dev/1Panel/releases for the corrective release - no exact fix version is confirmed from available data, so the patch status is 'patch available per vendor advisory' without an independently verified version number. As an interim compensating control, restrict network access to the 1Panel web interface to trusted IP ranges or a VPN-only path, which prevents an attacker from crafting a reachable CSRF payload targeting an isolated management network (trade-off: increases access friction for administrators). Additionally, ensuring the 1Panel session cookie carries the SameSite=Strict or SameSite=Lax attribute - if configurable - would neutralize cross-origin form submissions in modern browsers without requiring a code patch.