CVE-2023-36457

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. The vulnerability has been fixed in v1.3.6.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

Vendor	Product	Versions
1Panel-dev	1Panel	< 1.3.6
fit2cloud	1panel	< 1.3.6

References

https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6Release Notes
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8xExploit, Vendor Advisory
https://github.com/1Panel-dev/1Panel/releases/tag/v1.3.6Release Notes
https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-q2mx-gpjf-3h8xExploit, Vendor Advisory

Timeline

Published: Jul 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-364588.81Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craf CVE-2023-364596.1Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 1.3 and prior to versions 3.5.9, 4.0.5, and CVE-2023-36467.5On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel p CVE-2023-364609.9Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, an CVE-2023-364617.5Mastodon is a free, open-source social network server based on ActivityPub. When performing outgoing HTTP queries, Mastodon sets a timeout o CVE-2023-364625.4Mastodon is a free, open-source social network server based on ActivityPub. Starting in version 2.6.0 and prior to versions 3.5.9, 4.0.5, an CVE-2023-364636.1Meldekarten generator is an open source project to create a program, running locally in the browser without the need for an internet-connect CVE-2023-364645.5pypdf is an open source, pure-python PDF library. In affected versions an attacker may craft a PDF which leads to an infinite loop if `__par CVE-2023-364657.1Decidim is a participatory democracy framework, written in Ruby on Rails, originally developed for the Barcelona City government online and CVE-2023-364664.3Discourse is an open source discussion platform. When editing a topic, there is a vulnerability that enables a user to bypass the topic titl CVE-2023-364678.8AWS data.all is an open source development framework to help users build a data marketplace on Amazon Web Services. data.all versions 1.2.0 CVE-2023-364688.8XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When an XWiki installation is upgra