Vulnerability · Published Dec 10, 2025 · Assigned by VulnCheck

CVE-2025-344291Panel CSRF Web Port Configuration Change

High 7.0

In plain English

A high-severity cross-site request forgery in 1Panel from LXware. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)7.0High

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a port-change request; when a victim visits it while authenticated, the browser includes valid session cookies and the request succeeds. This allows an attacker to change the port on which the 1Panel web service listens, causing loss of access on the original port and resulting in service disruption or denial of service, and may unintentionally expose the service on an attacker-chosen port.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/1Panel-dev/1Panel	no fix listed	GHSA-wrvc-x3wf-j5f5
Go	github.com/1Panel-dev/1Panel	no fix listed	GO-2025-4231

Affected products (as reported)

Vendor	Product	Versions
LXware	1Panel	1.10.33 – through 2.0.15

Weakness: CWE-352 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

References

https://github.com/1Panel-dev/1Panel/releases product
https://1panel.pro/ product
https://www.vulncheck.com/advisories/1panel-csrf-web-port-configuration-change third-party-advisory