CVE-2026-34241 (GCVE-0-2026-34241)

Vulnerability from cvelistv5 – Published: 2026-05-19 21:09 – Updated: 2026-05-20 14:08
VLAI
Title
CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking
Summary
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\Notifications\Ticket\Admin\AdminReplyNotification (triggered when a user replies, targeting admins) and App\Notifications\Ticket\User\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.
Severity
8.7 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
SSVC
Exploitation: poc Automatable: no Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
Vendor Product Version
Ctrlpanel-gg panel Affected: < 1.2.0
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-34241",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-20T14:08:22.051750Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-20T14:08:56.728Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "panel",
          "vendor": "Ctrlpanel-gg",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.2.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade\u0027s {!! !!} syntax in the recipient\u0027s browser. The flaw exists in both App\\Notifications\\Ticket\\Admin\\AdminReplyNotification (triggered when a user replies, targeting admins) and App\\Notifications\\Ticket\\User\\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim\u0027s session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim\u0027s behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T21:09:14.048Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh"
        },
        {
          "name": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0"
        }
      ],
      "source": {
        "advisory": "GHSA-cmrr-q3hw-3vqh",
        "discovery": "UNKNOWN"
      },
      "title": "CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-34241",
    "datePublished": "2026-05-19T21:09:14.048Z",
    "dateReserved": "2026-03-26T16:22:29.034Z",
    "dateUpdated": "2026-05-20T14:08:56.728Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-34241",
      "date": "2026-07-24",
      "epss": "0.00349",
      "percentile": "0.27368"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-34241\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-19T22:16:37.297\",\"lastModified\":\"2026-07-24T09:10:00.153\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade\u0027s {!! !!} syntax in the recipient\u0027s browser. The flaw exists in both App\\\\Notifications\\\\Ticket\\\\Admin\\\\AdminReplyNotification (triggered when a user replies, targeting admins) and App\\\\Notifications\\\\Ticket\\\\User\\\\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim\u0027s session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim\u0027s behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.\"},{\"lang\":\"es\",\"value\":\"CtrlPanel es un software de facturaci\u00f3n de c\u00f3digo abierto para proveedores de alojamiento. Las versiones 1.1.1 y anteriores contienen una vulnerabilidad de cross-site scripting (XSS) almacenado en el sistema de notificaci\u00f3n de respuesta de tickets. El contenido de respuesta no saneado ($newmessage) se almacena directamente en las cargas \u00fatiles de notificaci\u00f3n de la base de datos y luego se renderiza sin escapar a trav\u00e9s de la sintaxis {!! !!} de Blade en el navegador del destinatario. La falla existe tanto en App\\\\Notifications\\\\Ticket\\\\Admin\\\\AdminReplyNotification (activada cuando un usuario responde, dirigida a administradores) como en App\\\\Notifications\\\\Ticket\\\\User\\\\ReplyNotification (activada cuando un administrador responde, dirigida a usuarios), permitiendo la ejecuci\u00f3n arbitraria de JavaScript en el contexto de la sesi\u00f3n de la v\u00edctima. Un atacante con pocos privilegios puede explotar esto para secuestrar sesiones de administrador, recolectar credenciales a trav\u00e9s de avisos de inicio de sesi\u00f3n falsos o keyloggers, y escalar privilegios realizando acciones administrativas en nombre de la v\u00edctima. La ruta inversa tambi\u00e9n permite que un administrador malicioso o comprometido ataque a usuarios regulares de la misma manera. Este problema ha sido solucionado en la versi\u00f3n 1.2.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"Ctrlpanel-gg\",\"product\":\"panel\",\"versions\":[{\"version\":\"\u003c 1.2.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N\",\"baseScore\":8.7,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.3,\"impactScore\":5.8}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-20T14:08:22.051750Z\",\"id\":\"CVE-2026-34241\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"references\":[{\"url\":\"https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-06-05T19:21:46+00:00",
      "cve": "CVE-2026-34241",
      "id": "CVE-2026-34241",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34241.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-34241\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-20T14:08:22.051750Z\"}}}], \"references\": [{\"url\": \"https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-20T14:08:47.529Z\"}}], \"cna\": {\"title\": \"CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking\", \"source\": {\"advisory\": \"GHSA-cmrr-q3hw-3vqh\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 8.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Ctrlpanel-gg\", \"product\": \"panel\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 1.2.0\"}]}], \"references\": [{\"url\": \"https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh\", \"name\": \"https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0\", \"name\": \"https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade\u0027s {!! !!} syntax in the recipient\u0027s browser. The flaw exists in both App\\\\Notifications\\\\Ticket\\\\Admin\\\\AdminReplyNotification (triggered when a user replies, targeting admins) and App\\\\Notifications\\\\Ticket\\\\User\\\\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim\u0027s session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim\u0027s behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-19T21:09:14.048Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-34241\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-20T14:08:56.728Z\", \"dateReserved\": \"2026-03-26T16:22:29.034Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-19T21:09:14.048Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.