OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/operate endpoint.
References
| Link | Resource |
|---|---|
| https://github.com/August829/CVEP/issues/5 | Issue Tracking |
| https://github.com/August829/Yu/blob/main/20250812_1.md | Broken Link |
Configurations
History
17 Sep 2025, 20:28
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
1panel 1panel
1panel |
|
| References | () https://github.com/August829/CVEP/issues/5 - Issue Tracking | |
| References | () https://github.com/August829/Yu/blob/main/20250812_1.md - Broken Link | |
| CPE | cpe:2.3:a:1panel:1panel:2.0.8:*:*:*:*:*:*:* |
10 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CWE | CWE-78 |
10 Sep 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-10 14:15
Updated : 2025-09-17 20:28
NVD link : CVE-2025-56413
Mitre link : CVE-2025-56413
CVE.ORG link : CVE-2025-56413
JSON object : View
Products Affected
1panel
- 1panel
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')