CVE-2026-34241 Details
Description
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\Notifications\Ticket\Admin\AdminReplyNotification (triggered when a user replies, targeting admins) and App\Notifications\Ticket\User\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.
A stored cross-site scripting vulnerability has been identified in CtrlPanel billing software for hosting providers, affecting versions through 1.1.1. The issue resides in the ticket reply notification system, where unsanitized reply content is directly stored in the database and later rendered unescaped in the recipient's browser. This flaw exists in both notification directions: when a user replies to a ticket, targeting admins, and when an admin replies, targeting users. Exploitation allows arbitrary JavaScript execution in the victim's session context, enabling session hijacking, credential harvesting, and privilege escalation. The vulnerability has been patched in version 1.2.0.
The vulnerability has been fixed in CtrlPanel version 1.2.0. Users should update to this version. The fix involves sanitizing the message content before it is embedded into the notification payload, using a method like 'strip_tags()' to remove any HTML or JavaScript that could be injected.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 19, 2026CISA-ADP
Assessed May 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0 | [email protected] | BundleRelease NotesVendor |
| https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| CtrlPanel | <= 1.1.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 20, 2026 | CVE Modified | CISA-ADP |
| May 19, 2026 | New CVE Received | [email protected] |