Vulnerability · Published May 19, 2026 · Assigned by GitHub_M
CVE-2026-34241CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking
High 8.7
In plain English
A high-severity cross-site scripting in panel from Ctrlpanel-gg. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 29% of all known vulnerabilities).
Official description
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\Notifications\Ticket\Admin\AdminReplyNotification (triggered when a user replies, targeting admins) and App\Notifications\Ticket\User\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ctrlpanel-gg | panel | < 1.2.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh x_refsource_CONFIRM
- https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0 x_refsource_MISC