Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Malicious Code Can Run on CyberPanel with Old Software

CVE-2026-41472 · published 6 months ago
Summary

Old versions of CyberPanel can be tricked by hackers to run malicious scripts on the server. This is because a part of CyberPanel's AI Scanner dashboard does not require a login to access. Hackers can inject code that will run when a CyberPanel administrator visits the AI Scanner dashboard, potentially allowing them to execute commands on the server. To fix this, update CyberPanel to version 2.4.4 or later.

What to do
  • Update cyberpanel cyberpanel to version 2.4.4 or later.
Affected software
VendorProductAffected versions
cyberpanel cyberpanel < 2.4.4
cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*
usmannasir cyberpanel < 2.4.4
< 2.4.5
Original advisory text
CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard
CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.3 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published24 Apr 2026
Updated4 Nov 2026
First seen24 Apr 2026
Sources
CVE-2026-41472 · NVD
CVE-2026-41472 · MITRE
CVE-2026-41472 · OSV
Track software like this
Free during beta