CVE-2026-41472 Details
Description
CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.
A stored cross-site scripting vulnerability has been identified in CyberPanel versions prior to 2.4.4. The issue resides in the AI Scanner dashboard, specifically within the POST /api/ai-scanner/callback endpoint, which lacks authentication. This vulnerability allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. The injected JavaScript executes in the context of an administrator's authenticated session when the AI Scanner dashboard is accessed. This exploitation enables the attacker to make same-origin requests to schedule cron jobs, ultimately leading to remote code execution on the server.
Users are advised to update CyberPanel to version 2.4.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/usmannasir/cyberpanel/commit/8eb29181cb137baa4adb4bba5dce60f601d55a5f | [email protected] | |
| https://itsrez.re/post/cyberpanel-rce | [email protected] | ExploitMitigationThird Party Advisory |
| https://www.vulncheck.com/advisories/cyberpanel-stored-xss-via-ai-scanner-dashboard | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| cyberpanel cyberpanel | < 2.4.4 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 11, 2026 | CVE Modified | [email protected] |
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 28, 2026 | Initial Analysis | [email protected] |
| Apr 24, 2026 | New CVE Received | [email protected] |