CVE-2026-41472: CyberPanel

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

Affected products

• CyberPanel CyberPanel: before 2.4.4 (fixed in 2.4.4)

Published 2026-04-24. Last modified 2026-08-11.