PT-2026-32128 · 1Panel+1 · 1Panel+1

Ana10Gy · Published 2026-04-12 · Updated 2026-04-12 · CVE-2026-6107

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1

Description A flaw exists in the processing of the file apps/common/middleware/chat headers middleware.py within the ChatHeadersMiddleware component. Manipulation of the Name argument can lead to cross site scripting. Remote exploitation is possible.

Recommendations Upgrade to version 2.8.0 to address this issue.

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2026-6107

Affected Products

1Panel

Maxkb

References · 12

• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Patch
• https://github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1da · Patch
• https://github.com/1Panel-dev/MaxKB/pull/4919 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6107 · Security Note
• https://vuldb.com/submit/782263 · Note
• https://vuldb.com/vuln/356966 · Note
• https://twitter.com/infoflowcloud/status/2043157290136555580 · Twitter Post
• https://github.com/AnalogyC0de/public_exp/issues/24 · Note
• https://vuldb.com/vuln/356966/cti · Note
• https://twitter.com/CVEarity/status/2043300118989094923 · Twitter Post
• https://github.com/1Panel-dev/MaxKB · Note
• https://twitter.com/CVEnew/status/2043156055379603789 · Twitter Post