CVE-2026-23525

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23525", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-13T18:22:43.980Z", "datePublished": "2026-01-18T22:10:59.500Z", "dateUpdated": "2026-01-20T20:07:16.229Z"}, "containers": {"cna": {"title": "1panel App Store vulnerable to Cross-site Scripting", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-mg24-6h5c-9q42", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-mg24-6h5c-9q42"}], "affected": [{"vendor": "1Panel-dev", "product": "1Panel", "versions": [{"version": "< 1.10.34", "status": "affected"}, {"version": ">= 2.0.0, < 2.0.17", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-18T22:10:59.500Z"}, "descriptions": [{"lang": "en", "value": "1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user\u2019s browser, potentially compromising session data or sensitive system interfaces. All versions of 1Panel up to and including v1.10.33-lts and v2.0.16 are affected. An attacker could publish a malicious application that, when loaded by users (locally or remotely), can execute arbitrary scripts. This may result in theft of user cookies, unauthorized access to system functions, or other actions that compromise the confidentiality, integrity, and availability of the system. The vulnerability is caused by insufficient sanitization of content rendered by the MdEditor component with the `previewOnly` attribute enabled. Specifically, the App Store renders application README content without proper XSS protection, allowing script execution during content rendering; and similar issues exist in system upgrade-related components, which can be fixed by implementing proper XSS sanitization in the MdEditor component. These vulnerabilities can be mitigated by applying proper XSS protection and sanitization when rendering content in the MdEditor component. Safe versions with a patch incorporated are v1.10.34-lts and v2.0.17."}], "source": {"advisory": "GHSA-mg24-6h5c-9q42", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-20T20:02:46.885126Z", "id": "CVE-2026-23525", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:07:16.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23525", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-20T20:02:46.885126Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-20T20:02:47.910Z"}}], "cna": {"title": "1panel App Store vulnerable to Cross-site Scripting", "source": {"advisory": "GHSA-mg24-6h5c-9q42", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "1Panel-dev", "product": "1Panel", "versions": [{"status": "affected", "version": "< 1.10.34"}, {"status": "affected", "version": ">= 2.0.0, < 2.0.17"}]}], "references": [{"url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-mg24-6h5c-9q42", "name": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-mg24-6h5c-9q42", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user\u2019s browser, potentially compromising session data or sensitive system interfaces. All versions of 1Panel up to and including v1.10.33-lts and v2.0.16 are affected. An attacker could publish a malicious application that, when loaded by users (locally or remotely), can execute arbitrary scripts. This may result in theft of user cookies, unauthorized access to system functions, or other actions that compromise the confidentiality, integrity, and availability of the system. The vulnerability is caused by insufficient sanitization of content rendered by the MdEditor component with the `previewOnly` attribute enabled. Specifically, the App Store renders application README content without proper XSS protection, allowing script execution during content rendering; and similar issues exist in system upgrade-related components, which can be fixed by implementing proper XSS sanitization in the MdEditor component. These vulnerabilities can be mitigated by applying proper XSS protection and sanitization when rendering content in the MdEditor component. Safe versions with a patch incorporated are v1.10.34-lts and v2.0.17."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-18T22:10:59.500Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23525", "state": "PUBLISHED", "dateUpdated": "2026-01-20T20:07:16.229Z", "dateReserved": "2026-01-13T18:22:43.980Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-18T22:10:59.500Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "1Panel", "vendor": "1Panel-dev", "versions": [{"status": "affected", "version": "< 1.10.34"}, {"status": "affected", "version": ">= 2.0.0, < 2.0.17"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F5968FDD-8F6D-487E-9326-0949B42D2BA3", "versionEndExcluding": "1.10.34", "vulnerable": true}, {"criteria": "cpe:2.3:a:fit2cloud:1panel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5D333955-D761-4982-A30A-D59D1735FCFD", "versionEndExcluding": "2.0.17", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user\u2019s browser, potentially compromising session data or sensitive system interfaces. All versions of 1Panel up to and including v1.10.33-lts and v2.0.16 are affected. An attacker could publish a malicious application that, when loaded by users (locally or remotely), can execute arbitrary scripts. This may result in theft of user cookies, unauthorized access to system functions, or other actions that compromise the confidentiality, integrity, and availability of the system. The vulnerability is caused by insufficient sanitization of content rendered by the MdEditor component with the `previewOnly` attribute enabled. Specifically, the App Store renders application README content without proper XSS protection, allowing script execution during content rendering; and similar issues exist in system upgrade-related components, which can be fixed by implementing proper XSS sanitization in the MdEditor component. These vulnerabilities can be mitigated by applying proper XSS protection and sanitization when rendering content in the MdEditor component. Safe versions with a patch incorporated are v1.10.34-lts and v2.0.17."}, {"lang": "es", "value": "1Panel es un panel de control de c\u00f3digo abierto, basado en web, para la gesti\u00f3n de servidores Linux. Una vulnerabilidad de cross-site scripting (XSS) almacenado existe en la Tienda de Aplicaciones de 1Panel al ver los detalles de la aplicaci\u00f3n. Scripts maliciosos pueden ejecutarse en el contexto del navegador del usuario, potencialmente comprometiendo datos de sesi\u00f3n o interfaces sensibles del sistema. Todas las versiones de 1Panel hasta e incluyendo v1.10.33-lts y v2.0.16 est\u00e1n afectadas. Un atacante podr\u00eda publicar una aplicaci\u00f3n maliciosa que, cuando es cargada por los usuarios (local o remotamente), puede ejecutar scripts arbitrarios. Esto puede resultar en el robo de cookies de usuario, acceso no autorizado a funciones del sistema u otras acciones que comprometan la confidencialidad, integridad y disponibilidad del sistema. La vulnerabilidad es causada por una sanitizaci\u00f3n insuficiente del contenido renderizado por el componente MdEditor con el atributo 'previewOnly' habilitado. Espec\u00edficamente, la Tienda de Aplicaciones renderiza contenido README de la aplicaci\u00f3n sin la protecci\u00f3n XSS adecuada, permitiendo la ejecuci\u00f3n de scripts durante la renderizaci\u00f3n del contenido; y problemas similares existen en componentes relacionados con la actualizaci\u00f3n del sistema, los cuales pueden ser solucionados implementando una sanitizaci\u00f3n XSS adecuada en el componente MdEditor. Estas vulnerabilidades pueden ser mitigadas aplicando protecci\u00f3n y sanitizaci\u00f3n XSS adecuadas al renderizar contenido en el componente MdEditor. Las versiones seguras con un parche incorporado son v1.10.34-lts y v2.0.17."}], "id": "CVE-2026-23525", "lastModified": "2026-06-17T10:21:43.613", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.5, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23525", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-20T20:02:46.885126Z", "version": "2.0.3"}}]}, "published": "2026-01-18T23:15:48.220", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-mg24-6h5c-9q42"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T19:06:32.186670+00:00", "value": {"mitigation_remediation": ["Upgrade to v1.10.34\u2011lts or v2.0.17, which contain the fix for MdEditor sanitization.", "If an upgrade cannot be performed immediately, block the installation of new applications from the App Store or disable the App Store feature until the patch is applied.", "Verify that MdEditor is configured to enforce proper XSS sanitization for previewOnly rendering, or apply the vendor\u2019s patch to enforce this behavior."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting enabling cookie theft and unauthorized system access"}, "threat_synthesis": {"affected_systems": "All supported releases of 1Panel up to and including v1.10.33\u2011lts and v2.0.16 are affected. The vendor supplied patched releases are v1.10.34\u2011lts and v2.0.17.", "description_and_impact": "1Panel is an open\u2011source web\u2011based control panel for Linux servers that offers an App Store for installing applications. A stored Cross\u2011Site Scripting vulnerability exists in the App Store when viewing application details. The flaw arises from insufficient sanitization of content rendered by the MdEditor component with previewOnly mode enabled. An attacker can embed arbitrary scripts into the README of a malicious application; when a logged\u2011in user views the details, the scripts execute in the victim\u2019s browser context. The result is the theft of session cookies and potentially unauthorized access to system functions, thereby compromising confidentiality, integrity, and availability. The likely attack vector is inferred as a malicious application published to the App Store, which the vulnerability does not explicitly state but is derived from the description.", "risk_and_exploitability": "The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% demonstrates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread attacks have been observed. Exploitation would require a malicious application to be published to the App Store and subsequently viewed by a logged\u2011in user; this is inferred from the description. Successful exploitation would allow an attacker to steal credentials or perform privileged actions from the victim\u2019s browser session."}}}}, "created": "2026-01-19T09:19:07.477782+00:00", "updated": "2026-04-18T19:15:10.606788+00:00", "vendors": ["1panel", "1panel$PRODUCT$1panel"]}