{"id":"EUVD-2025-201792","enisaUuid":"59e91367-693b-3ee2-8a8d-9482e3ebac19","description":"1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin\u0027s default configuration which trusts all IP addresses as proxies (TrustedProxies \u003d 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For:  127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.","datePublished":"Dec 9, 2025, 1:37:10 AM","dateUpdated":"Dec 9, 2025, 4:03:08 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765\nhttps://github.com/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed\n","aliases":"CVE-2025-66508\nGHSA-7cqv-qcq2-r765\n","assigner":"GitHub_M","epss":0.25,"enisaIdProduct":[{"id":"0f6753c1-fae2-3496-b162-bef6a6eb871e","product":{"name":"1Panel","vendor":{"name":"1Panel-dev"}},"product_version":"\u003c 2.0.14"}],"enisaIdVendor":[{"id":"c8d7a710-c7b7-3df3-980a-1d43bf2f4413","vendor":{"name":"1Panel-dev"}}],"enisaIdVulnerability":[{"id":"655061ba-9618-3dc8-a182-11d1e96f0427","vulnerability":{"id":"GHSA-7cqv-qcq2-r765","description":"1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers","datePublished":"Dec 8, 2025, 5:56:57 PM","dateUpdated":"Dec 17, 2025, 12:47:24 AM","baseScore":0.0,"references":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-66508\nhttps://github.com/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed\nhttps://github.com/1Panel-dev/1Panel\n","enisa_id":"EUVD-2025-201792\n","aliases":"GHSA-7cqv-qcq2-r765\nCVE-2025-66508\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b77b11ca-31c3-3c40-864a-1c8dd12ed7cc","vulnerability":{"id":"CVE-2025-66508","description":"1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin\u0027s default configuration which trusts all IP addresses as proxies (TrustedProxies \u003d 0.0.0.0/0), allowing any client to spoof the X-Forwarded-For header. Since all IP-based access controls (AllowIPs, API whitelists, localhost-only checks) rely on ClientIP(), attackers can bypass these protections by simply sending X-Forwarded-For:  127.0.0.1 or any whitelisted IP. This renders all IP-based security controls ineffective. This issue is fixed in version 2.0.14.","datePublished":"Dec 9, 2025, 1:37:10 AM","dateUpdated":"Dec 9, 2025, 4:03:08 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","references":"https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-7cqv-qcq2-r765\nhttps://github.com/1Panel-dev/1Panel/commit/94f7d78cc9768ee244da33e09408017d1f68b5ed\n","enisa_id":"EUVD-2025-201792\n","assigner":"GitHub_M","epss":0.25,"dataProcessed":"Nov 6, 2026, 7:21:48 AM","vulnerabilityProduct":[{"id":"426286ff-7885-3838-822d-8d0f33f04d08","product":{"name":"1Panel","vendor":{"name":"1Panel-dev"}},"product_version":"\u003c 2.0.14"}],"vulnerabilityVendor":[{"id":"fb9bd2b2-1291-34dd-a078-71fe0a2f4680","vendor":{"name":"1Panel-dev"}}]}}],"enisaIdAdvisory":[]}