Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

1Panel-dev/1Panel

              dev-v2 @ 3c0bd05
            

113

Fixes

CVEs

CRITICAL

Peak severity

31.6%

Coverage

Highlights

Auth Bypass: 35 prior fixes. Scrutinize any change in this area.

backend/app/api/v1/file.go: most-fixed (7 issues). Treat as high-risk during review.

67 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Dominant vulnerability class with 35+ fixes; recurring root causes include IP spoofing via X-Forwarded-For, middleware ordering errors, missing return statements, and logical operator mistakes in credential checks.

Command Injection: 12 fixes plus multiple CVEs (CVE-2025-56413, CVE-2024-34352, CVE-2023-37477) show persistent shell injection via string interpolation; mitigations rely on character blocklists that are repeatedly bypassed (added <, >, newline).

Path Traversal: 12 fixes and multiple CVEs (CVE-2023-39964, CVE-2023-39966) indicate file read/write/download endpoints repeatedly lacked path canonicalization and prefix checks; some endpoints were removed entirely.