1Panel CVE-2025-34430

The victim must be actively authenticated to a 1Panel instance (versions 1.10.33-2.0.15) and must visit an attacker-controlled webpage while their session cookie is valid - this is the UI:A requirement in the CVSS 4.0 vector. The 1Panel instance must be network-reachable from the victim's browser at the time of the visit; an instance bound to localhost or an isolated management VLAN is not reachable from an external malicious page. No server-side misconfiguration or non-default feature flag is required - the vulnerability is present in the default installation because CSRF protections are absent from the endpoint by design. Exploitation is strictly bounded to panel name modification (low integrity impact); it does not grant code execution, credential access, or privilege escalation.

The CVSS 4.0 score of 5.1 (Medium) is consistent with the actual impact: AV:N/AC:L/AT:N reflect easy network delivery with no special attack conditions, but UI:A correctly constrains exploitation to scenarios where the victim actively visits the attacker's page. The only confirmed impact is VI:L - panel name modification - with no confidentiality or availability consequence. No EPSS data is available from the provided intelligence; no CISA KEV listing exists, and no public exploit or POC has been identified. Collectively, these signals place this vulnerability at low operational priority: it is not remotely exploitable without victim interaction, and successful exploitation yields only a cosmetic/configuration change rather than credential theft, code execution, or data exfiltration. Security teams maintaining 1Panel installations should patch opportunistically rather than on an emergency basis.

An attacker creates a webpage containing a hidden HTML form pointing to the victim's 1Panel instance panel-name endpoint, set to auto-submit on page load. When an authenticated 1Panel administrator is socially engineered into visiting the page - via phishing email or malicious link - their browser fires the form submission with the active session cookie attached, changing the panel name to an arbitrary attacker-chosen string. No public POC exists at this time, but the technique is trivially reproducible given the description.