PT-2026-35083 · Usmannasir · Cyberpanel

Djibril Mounkoro · Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-41472

Mitre

CVSS v4.0

5.3

Medium

AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findings json field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-41472

Affected Products

Cyberpanel

References · 4

• 🔥 https://itsrez.re/post/cyberpanel-rce · Exploit
• https://github.com/usmannasir/cyberpanel/commit/0a099b1b193946555fbdd387a28486b1521f9961 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41472 · Security Note
• https://vulncheck.com/advisories/cyberpanel-stored-xss-via-ai-scanner-dashboard · Note