CVE-2026-34241

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34241", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-26T16:22:29.034Z", "datePublished": "2026-05-19T21:09:14.048Z", "dateUpdated": "2026-05-20T14:08:56.728Z"}, "containers": {"cna": {"title": "CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh"}, {"name": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0"}], "affected": [{"vendor": "Ctrlpanel-gg", "product": "panel", "versions": [{"version": "< 1.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T21:09:14.048Z"}, "descriptions": [{"lang": "en", "value": "CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\\Notifications\\Ticket\\Admin\\AdminReplyNotification (triggered when a user replies, targeting admins) and App\\Notifications\\Ticket\\User\\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0."}], "source": {"advisory": "GHSA-cmrr-q3hw-3vqh", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-20T14:08:22.051750Z", "id": "CVE-2026-34241", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T14:08:56.728Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34241", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-20T14:08:22.051750Z"}}}], "references": [{"url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-20T14:08:47.529Z"}}], "cna": {"title": "CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking", "source": {"advisory": "GHSA-cmrr-q3hw-3vqh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Ctrlpanel-gg", "product": "panel", "versions": [{"status": "affected", "version": "< 1.2.0"}]}], "references": [{"url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh", "name": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0", "name": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\\Notifications\\Ticket\\Admin\\AdminReplyNotification (triggered when a user replies, targeting admins) and App\\Notifications\\Ticket\\User\\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-19T21:09:14.048Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34241", "state": "PUBLISHED", "dateUpdated": "2026-05-20T14:08:56.728Z", "dateReserved": "2026-03-26T16:22:29.034Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-19T21:09:14.048Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "panel", "vendor": "Ctrlpanel-gg", "versions": [{"status": "affected", "version": "< 1.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\\Notifications\\Ticket\\Admin\\AdminReplyNotification (triggered when a user replies, targeting admins) and App\\Notifications\\Ticket\\User\\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0."}, {"lang": "es", "value": "CtrlPanel es un software de facturaci\u00f3n de c\u00f3digo abierto para proveedores de alojamiento. Las versiones 1.1.1 y anteriores contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en el sistema de notificaci\u00f3n de respuesta de tickets. El contenido de respuesta no saneado ($newmessage) se almacena directamente en las cargas \u00fatiles de notificaci\u00f3n de la base de datos y luego se renderiza sin escapar a trav\u00e9s de la sintaxis {!! !!} de Blade en el navegador del destinatario. La falla existe tanto en App\\Notifications\\Ticket\\Admin\\AdminReplyNotification (activada cuando un usuario responde, dirigida a administradores) como en App\\Notifications\\Ticket\\User\\ReplyNotification (activada cuando un administrador responde, dirigida a usuarios), permitiendo la ejecuci\u00f3n arbitraria de JavaScript en el contexto de la sesi\u00f3n de la v\u00edctima. Un atacante con pocos privilegios puede explotar esto para secuestrar sesiones de administrador, recolectar credenciales a trav\u00e9s de avisos de inicio de sesi\u00f3n falsos o keyloggers, y escalar privilegios realizando acciones administrativas en nombre de la v\u00edctima. La ruta inversa tambi\u00e9n permite que un administrador malicioso o comprometido ataque a usuarios regulares de la misma manera. Este problema ha sido solucionado en la versi\u00f3n 1.2.0."}], "id": "CVE-2026-34241", "lastModified": "2026-07-24T09:10:00.153", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34241", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-20T14:08:22.051750Z", "version": "2.0.3"}}]}, "published": "2026-05-19T22:16:37.297", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "panel", "source": "cna", "vendor": "Ctrlpanel-gg"}, "product": "panel", "vendor": "ctrlpanel-gg"}], "created": "2026-05-19T22:30:15.621856+00:00", "updated": "2026-05-20T10:38:57.086940+00:00", "vendors": ["ctrlpanel-gg", "ctrlpanel-gg$PRODUCT$panel"]}