PT-2026-3400 · 1Panel · 1Panel

Loolst · Published 2026-01-18 · Updated 2026-03-13 · CVE-2026-23525

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions 1Panel versions through 1.10.33-lts 1Panel versions through 2.0.16

Description 1Panel is a web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) issue exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data or sensitive system interfaces. The vulnerability is caused by insufficient sanitization of content rendered by the MdEditor component with the previewOnly attribute enabled. Specifically, the App Store renders application README content without proper XSS protection, allowing script execution during content rendering. Similar issues exist in system upgrade-related components. An attacker could publish a malicious application that, when loaded by users, can execute arbitrary scripts.

Recommendations Update to version 1.10.34-lts or later. Update to version 2.0.17 or later. Implement proper XSS protection and sanitization when rendering content in the MdEditor component.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-23525

GHSA-MG24-6H5C-9Q42

Affected Products

1Panel

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23525.json · Exploit
• https://github.com/1Panel-dev/1Panel/security/advisories/GHSA-mg24-6h5c-9q42 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23525 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23525 · Vendor Advisory
• https://t.me/cveNotify/155404 · Telegram Post
• https://twitter.com/CVEnew/status/2013017990342791615 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2013040015350108305 · Twitter Post