CVE-2026-34241
Stored XSS in CtrlPanel Ticket Reply Notifications
Publication date: 2026-05-19
Last updated on: 2026-05-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ctrlpanel | ctrlpanel | to 1.2.0 (exc) |
| ctrlpanel | ctrlpanel | 1.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Stored Cross-Site Scripting (XSS) issue found in CtrlPanel, an open-source billing software for hosting providers, in versions 1.1.1 and earlier.
The problem occurs in the ticket reply notification system where unsanitized reply content is stored directly in the database and later rendered without escaping in the recipient's browser using Blade's {!! !!} syntax.
This flaw exists in both notifications sent to admins when users reply and notifications sent to users when admins reply, allowing arbitrary JavaScript execution in the victim's session context.
A low-privileged attacker can exploit this to hijack admin sessions, steal credentials through fake login prompts or keyloggers, and escalate privileges by performing administrative actions on behalf of the victim.
Similarly, a malicious or compromised admin can exploit this to target regular users in the same way.
This vulnerability was fixed in version 1.2.0.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including the hijacking of administrator sessions, which allows attackers to gain unauthorized access to administrative functions.
Attackers can harvest credentials by tricking victims with fake login prompts or keyloggers injected via the XSS vulnerability.
Privilege escalation is possible, enabling attackers to perform administrative actions on behalf of the victim, potentially compromising the entire system.
Both low-privileged users and malicious administrators can exploit this vulnerability to target other users or admins, increasing the risk of widespread compromise.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability exists in CtrlPanel versions 1.1.1 and prior and has been fixed in version 1.2.0.
To mitigate this vulnerability immediately, upgrade CtrlPanel to version 1.2.0 or later.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows low-privileged attackers to execute arbitrary JavaScript in the victim's session context, potentially hijacking admin sessions, harvesting credentials, and escalating privileges. Such unauthorized access and data exposure could lead to violations of data protection regulations like GDPR and HIPAA, which mandate the protection of personal and sensitive information from unauthorized access and breaches.
By enabling attackers to compromise user sessions and harvest credentials, this vulnerability increases the risk of data breaches and unauthorized data processing, which are critical compliance concerns under these standards.