CVE-2025-34430: 1Panel CSRF Panel Name Modification
1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. An attacker can craft a malicious webpage that submits a panel-name change request; if a victim visits the page while authenticated, the browser includes valid session cookies and the request succeeds. This allows a remote attacker to change the victim’s panel name to an arbitrary value without consent.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
1Panelto a version that resolves this vulnerability.Fixed in 2.0.15 - Configuration
Enable CSRF protections for panel name change requests (e.g., anti-CSRF tokens and/or Origin/Referer validation) on the panel name management functionality.
1Panel panel name management endpoint CSRF defenses (anti-CSRF token and/or Origin/Referer validation) = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34430?
CVE-2025-34430 is classified as a medium severity cross-site request forgery (CSRF) vulnerability.
How do I fix CVE-2025-34430?
To fix CVE-2025-34430, ensure that you upgrade 1Panel to a version higher than 2.0.15.
What versions are affected by CVE-2025-34430?
CVE-2025-34430 affects 1Panel versions from 1.10.33 through 2.0.15.
What type of vulnerability is CVE-2025-34430?
CVE-2025-34430 is a cross-site request forgery (CSRF) vulnerability.
Can attackers exploit CVE-2025-34430 remotely?
Yes, attackers can exploit CVE-2025-34430 remotely by crafting malicious requests targeting the vulnerable panel name management functionality.