PT-2026-32127 · 1Panel Dev · Maxkb

Ana10Gy · Published 2026-04-11 · Updated 2026-04-11 · CVE-2026-6106

NVD

CVSS v2.0

4.0

Medium

AV:N/AC:L/Au:S/C:N/I:P/A:N

A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/static headers middleware.py of the component Public Chat Interface. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 2.8.0 is able to resolve this issue. The patch is identified as 026a2d623e2aa5efa67c4834651e79d5d7cab1da. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Exploit

Fix

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2026-6106

Affected Products

Maxkb

References · 9

• 🔥 https://github.com/AnalogyC0de/public_exp/issues/23 · Exploit
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Patch
• https://github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1da · Patch
• https://github.com/1Panel-dev/MaxKB/pull/4919 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6106 · Security Note
• https://vuldb.com/submit/781810 · Note
• https://vuldb.com/vuln/356965 · Note
• https://github.com/1Panel-dev/MaxKB · Note
• https://vuldb.com/vuln/356965/cti · Note