[Bug] Security Bug: Switching PHP Versions Causes Protected Directory to Download PHP Source Code
维护者通常 1 天内回复
@wanghe-fit2cloud 已经在做这个了。
开始于 2026年10月28日。
评估
这个 Issue 还没有评估数据。
描述
Contact Information
No response
1Panel Version
2.4.1
Problem Description
A potential security vulnerability in 1Panel allows PHP source code to be downloaded when accessing a directory protected by Basic Authentication after switching the website's PHP runtime version.
The issue is consistently reproducible in a freshly installed 1Panel virtual machine. After switching the PHP version, accessing the password-protected directory causes the browser to download the actual PHP source code instead of executing it.
The downloaded file contains the complete, current source code, including comments. Modifying index.php on the server changes the downloaded content accordingly.
This may expose sensitive application source code and credentials.
Environment
- 1Panel: Fresh installation in a virtual machine
- Initial PHP runtime: PHP 8.5.12
- Target PHP runtimes tested: PHP 7.0 and PHP 8.3
- Web server: OpenResty 1.31.1.1-2-4-noble
- Authentication method: Basic Authentication (password protection for a directory)
Actual Behavior
Instead of executing PHP scripts, the browser downloads a PHP source file.
When accessing the directory directly, the downloaded file contains the PHP entry-point code. When explicitly accessing index.php, the browser downloads the website's actual index.php file.
The downloaded source code is complete and up to date. If the contents of index.php are modified on the server, the downloaded file reflects those changes, including comments.
Restarting the server does not resolve the issue.
The problem has been reproduced with both PHP 7.0 and PHP 8.3 after switching from PHP 8.5.
Disabling the browser cache makes the website accessible again, but the underlying cause of the source-code exposure remains unclear.
Expected Behavior
Switching the website's PHP runtime version should not affect Basic Authentication or PHP request handling.
PHP files in password-protected directories should always be processed by PHP-FPM and should never be served as downloadable source code.
Security Impact
This behavior may expose the complete PHP source code of a website to unauthorized users, potentially including database credentials, API tokens, authentication logic, and other sensitive information.
Because the issue is reproducible after switching PHP versions and persists across server restarts, it should be investigated as a potential high-severity security vulnerability.
Additional Notes
- The issue is reproducible on a freshly installed 1Panel virtual machine.
- The password protection works correctly before switching PHP versions.
- Removing the Basic Authentication configuration afterward does not immediately resolve the issue in the affected browser.
- The issue has been reproduced with PHP 7.0 and PHP 8.3; other target PHP versions have not yet been tested.
Please investigate whether switching PHP runtime versions causes incorrect configuration generation or location matching for directories protected by Basic Authentication, resulting in PHP files being served as static files.
Steps to Reproduce
- Install 1Panel in a virtual machine.
- Install the PHP 8.5 runtime environment.
- Create a website and configure it to use PHP 8.5.
- Configure Basic Authentication to protect a specific directory of the website (eg: /test/).
- Access the protected directory and verify that the password prompt appears and authentication works correctly.
- Switch the website's PHP runtime from PHP 8.5 to PHP 7.0 or PHP 8.3.
- Access the same password-protected directory again.
The expected correct result
No response
Related log output
Additional Information
No response
- 主要语言
- Go
- 星标
- 37.3k
- 派生
- 3.4k
- 平均合并
- 9 小时 52 分钟
- 30 天内合并 PR
- 99
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
1Panel-dev/1Panel 的其他 Issue
-
[Bug] 升级失败可能已有人在做 @wanghe-fit2cloud 于 1 天前认领。 未关闭type: question
1Panel-dev/1Panel#14242 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
[Feature] 计划任务 备份网站 不能 选择网站分组可能已有人在做 @wanghe-fit2cloud 于 1 天前认领。 未关闭
1Panel-dev/1Panel#14241 · 已指派 1 人 ·
维护者通常 1 天内回复
-
Node.js has officially been upgraded to 26.13.0 (LTS version). Please upgrade the Node.js environment.可能已有人在做 @wanghe-fit2cloud 于 1 天前认领。 未关闭type: optimization
1Panel-dev/1Panel#14238 · 已指派 1 人 ·
维护者通常 1 天内回复
-
[Feature] The account pool of the AI gateway allows configuring a default prefix for accounts.可能已有人在做 @wanghe-fit2cloud 于 1 天前认领。 未关闭type: ai-gateway
1Panel-dev/1Panel#14230 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
-
[Feature] Optimize the Sub-Node Upgrade Process可能已有人在做 @wanghe-fit2cloud 于 2 天前认领。 未关闭type: optimization
1Panel-dev/1Panel#14227 · 1 条评论 · 已指派 1 人 ·
维护者通常 1 天内回复
查看 1Panel-dev/1Panel 的全部 Issue
相似的 Issue
-
area:web p3
难度 2/5 1-3 小时 新手友好度 72/100
Lets-Parley/Parley#912 ·
维护者通常 1 天内回复
-
enhancement help wanted
难度 2/5 1-3 小时 新手友好度 76/100
Git-Hospital/githealthcheck#61 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
afreidah/s3-orchestrator#1824 ·
维护者通常 1 天内回复
-
Type: Bug
难度 2/5 1-3 小时 新手友好度 72/100
projectdiscovery/notify#569 ·
-
internal
难度 2/5 1-3 小时 新手友好度 70/100
维护者通常 1 天内回复