PT-2026-32576 · Maxkb · Maxkb

Liqiang-Fit2Cloud · CVE-2026-39422 · Published 2026-04-14 · Updated 2026-04-14

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MaxKB versions prior to 2.8.0

Description A Stored Cross-Site Scripting (XSS) issue exists when creating an application via the application name or icon fields. When a user visits the public chat interface '/ui/chat/{access token}', the ChatHeadersMiddleware retrieves application data and inserts the unescaped name and icon into the HTML response using string replacement. This allows for the execution of arbitrary JavaScript in the browser context of the victim.

Recommendations Update to version 2.8.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-39422

GHSA-WF7P-3JQ5-Q52W

Affected Products

Maxkb

References · 9

• 🔥 https://github.com/1Panel-dev/MaxKB/security/advisories/GHSA-wf7p-3jq5-q52w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/39xxx/CVE-2026-39422.json · Exploit
• https://github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1da · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-39422 · Security Note
• https://osv.dev/vulnerability/CVE-2026-39422 · Vendor Advisory
• https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 · Note
• https://twitter.com/CVEarity/status/2044095536224260135 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2043998383736557616 · Twitter Post
• https://twitter.com/CVEnew/status/2043976151635230988 · Twitter Post