PT-2026-42017 · Ctrlpanel · Ctrlpanel

Published 2026-05-19 · Updated 2026-05-20 · CVE-2026-34241

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions CtrlPanel versions prior to 1.2.0

Description A Stored Cross-Site Scripting (XSS) issue exists in the ticket reply notification system. Unsanitized content from the $newmessage variable is stored in database notification payloads and rendered without escaping in the recipient's browser. This occurs within the AppNotificationsTicketAdminAdminReplyNotification function (affecting admins when a user replies) and the AppNotificationsTicketUserReplyNotification function (affecting users when an admin replies). This allows for arbitrary JavaScript execution, which can lead to session hijacking, credential harvesting through fake login prompts or keyloggers, and privilege escalation.

Recommendations Update to version 1.2.0.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-34241

Affected Products

Ctrlpanel

References · 7

• 🔥 https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-cmrr-q3hw-3vqh · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-34241 · Security Note
• https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0 · Note
• https://t.me/CVEtracker/54292 · Telegram Post
• https://twitter.com/CVEnew/status/2056870176327397737 · Twitter Post
• https://t.me/cveNotify/164224 · Telegram Post
• https://t.me/cveNotify/164266 · Telegram Post