CVE-2026-6106 Details
Description
A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/static_headers_middleware.py of the component Public Chat Interface. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 2.8.0 is able to resolve this issue. The patch is identified as 026a2d623e2aa5efa67c4834651e79d5d7cab1da. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
A stored cross-site scripting vulnerability has been identified in 1Panel-dev MaxKB versions through 2.2.1. The issue arises in the Public Chat Interface, specifically within the StaticHeadersMiddleware function of the file apps/common/middleware/static_headers_middleware.py. The vulnerability is caused by improper HTML escaping of application names and icons. An authenticated user can exploit this by injecting a malicious payload into the application name, which is then executed as JavaScript in the context of the victim's browser when they access the chat interface. This vulnerability can be exploited remotely, requiring user interaction.
Users are advised to upgrade to MaxKB version 2.8.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 11, 2026CISA-ADP
Assessed Apr 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/1Panel-dev/MaxKB/ | [email protected] | ProductVendor |
| https://github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1da | [email protected] | Source CodeVendor |
| https://github.com/1Panel-dev/MaxKB/pull/4919 | [email protected] | Issue TrackingVendor |
| https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 | [email protected] | Release NotesVendor |
| https://github.com/AnalogyC0de/public_exp/issues/23 | [email protected] | ExploitIssue TrackingTechnical Description |
| https://vuldb.com/submit/781810 | [email protected] | Technical Description |
| https://vuldb.com/vuln/356965 | [email protected] | AdvisoryExploitRemedy |
| https://vuldb.com/vuln/356965/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| 1Panel-dev MaxKB | All versions |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Apr 11, 2026 | New CVE Received | [email protected] |