Hacktoberfest 2026: những issue maintainer đã đánh dấu cho tháng Mười, đang mở và phù hợp người mới. Xem issue Hacktoberfest

[Bug] Security Bug: Switching PHP Versions Causes Protected Directory to Download PHP Source Code

Đang mở
  • Có gì không ổn?
#14,234 2 bình luận 0 reaction 1 người được giao Xem trên GitHub

Maintainer thường phản hồi trong vòng 1 ngày

@wanghe-fit2cloud đang làm issue này rồi.

Từ ngày 28/10/2026.

Đánh giá

Issue này chưa được đánh giá.

Mô tả

Contact Information

No response

1Panel Version

2.4.1

Problem Description

A potential security vulnerability in 1Panel allows PHP source code to be downloaded when accessing a directory protected by Basic Authentication after switching the website's PHP runtime version.

The issue is consistently reproducible in a freshly installed 1Panel virtual machine. After switching the PHP version, accessing the password-protected directory causes the browser to download the actual PHP source code instead of executing it.

The downloaded file contains the complete, current source code, including comments. Modifying index.php on the server changes the downloaded content accordingly.

This may expose sensitive application source code and credentials.

Environment

  • 1Panel: Fresh installation in a virtual machine
  • Initial PHP runtime: PHP 8.5.12
  • Target PHP runtimes tested: PHP 7.0 and PHP 8.3
  • Web server: OpenResty 1.31.1.1-2-4-noble
  • Authentication method: Basic Authentication (password protection for a directory)

Actual Behavior

Instead of executing PHP scripts, the browser downloads a PHP source file.

When accessing the directory directly, the downloaded file contains the PHP entry-point code. When explicitly accessing index.php, the browser downloads the website's actual index.php file.

The downloaded source code is complete and up to date. If the contents of index.php are modified on the server, the downloaded file reflects those changes, including comments.

Restarting the server does not resolve the issue.

The problem has been reproduced with both PHP 7.0 and PHP 8.3 after switching from PHP 8.5.

Disabling the browser cache makes the website accessible again, but the underlying cause of the source-code exposure remains unclear.

Expected Behavior

Switching the website's PHP runtime version should not affect Basic Authentication or PHP request handling.

PHP files in password-protected directories should always be processed by PHP-FPM and should never be served as downloadable source code.

Security Impact

This behavior may expose the complete PHP source code of a website to unauthorized users, potentially including database credentials, API tokens, authentication logic, and other sensitive information.

Because the issue is reproducible after switching PHP versions and persists across server restarts, it should be investigated as a potential high-severity security vulnerability.

Additional Notes

  • The issue is reproducible on a freshly installed 1Panel virtual machine.
  • The password protection works correctly before switching PHP versions.
  • Removing the Basic Authentication configuration afterward does not immediately resolve the issue in the affected browser.
  • The issue has been reproduced with PHP 7.0 and PHP 8.3; other target PHP versions have not yet been tested.

Please investigate whether switching PHP runtime versions causes incorrect configuration generation or location matching for directories protected by Basic Authentication, resulting in PHP files being served as static files.

Steps to Reproduce
  1. Install 1Panel in a virtual machine.
  2. Install the PHP 8.5 runtime environment.
  3. Create a website and configure it to use PHP 8.5.
  4. Configure Basic Authentication to protect a specific directory of the website (eg: /test/).
  5. Access the protected directory and verify that the password prompt appears and authentication works correctly.
  6. Switch the website's PHP runtime from PHP 8.5 to PHP 7.0 or PHP 8.3.
  7. Access the same password-protected directory again.
The expected correct result

No response

Related log output
Additional Information

No response

Ngôn ngữ chính
Go
Star
37.3k
Fork
3.4k
Merge trung bình
10 giờ 13 phút
Pull request đã merge (30 ngày)
99

Chuẩn bị môi trường

Bắt đầu từ đâu

  1. Đọc hết issue, rồi đọc hướng dẫn đóng góp của dự án.
  2. Bình luận trên issue rằng bạn sẽ nhận — tránh hai người làm cùng một việc.
  3. Fork repository và làm thay đổi trên một nhánh.
  4. Mở pull request có tham chiếu số hiệu của issue.

Issue khác của 1Panel-dev/1Panel

Tất cả issue của 1Panel-dev/1Panel

Issue tương tự

Thêm issue về Go

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.