What is the CVSS score of CVE-2026-34241?

CVE-2026-34241 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of CtrlPanel are affected by CVE-2026-34241?

CtrlPanel versions 1.1.1 and earlier contain a privilege escalation vulnerability in ticket notifications that allows authenticated users to compromise administrator accounts through malicious code…. A patch is available.

How to fix or mitigate CVE-2026-34241?

24 hours: Inventory all CtrlPanel deployments and identify current version; audit all accounts with administrator privileges; implement centralized logging and real-time monitoring for ticket reply content containing JavaScript patterns. 7 days: Deploy Content Security Policy (CSP) headers with `script-src 'self'` directive to restrict inline script execution; apply HTML entity encoding to all notification rendering in ticket system; review and restrict ticket creation permissions to minimize blast radius if compromise occurs. 30 days: Upgrade CtrlPanel to vendor-released patched version when available (monitor vendor advisory); evaluate alternative ticket management solutions if patch timeline extends beyond 90 days; implement administrative account isolation with separate interface segregated from user-submitted content.

CtrlPanel CVE-2026-34241

EUVD-2026-30987 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-19 GitHub_M

XSS Panel

8.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

May 19, 2026 - 22:02 EUVD

Source Code Evidence Fetched

May 19, 2026 - 22:00 vuln.today

Analysis Generated

May 19, 2026 - 22:00 vuln.today

DescriptionGitHub Advisory

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\Notifications\Ticket\Admin\AdminReplyNotification (triggered when a user replies, targeting admins) and App\Notifications\Ticket\User\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.

AnalysisAI

Stored cross-site scripting in CtrlPanel (versions ≤1.1.1) allows a low-privileged ticket participant to inject arbitrary JavaScript into reply notifications that execute in the recipient's browser when rendered via Blade's unescaped {!! !!} directive. Because notifications flow bidirectionally between users and admins, a regular user can hijack an admin session - yielding privilege escalation across a scope-changed (S:C) trust boundary - and a malicious admin can pivot back to target users. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the attack path is straightforward given an authenticated low-privileged account and an admin reading the ticket queue.

Technical ContextAI

CtrlPanel is a PHP/Laravel-based open-source billing and management panel for hosting providers (CPE: cpe:2.3:a:ctrlpanel-gg:panel). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): the $newmessage variable from a ticket reply is persisted into the notifications table payload without sanitization, and the corresponding Blade notification template renders that payload using {!! $variable !!} - Laravel's explicit raw-output syntax that bypasses the default HTML escaping {{ }} provides. Both App\Notifications\Ticket\Admin\AdminReplyNotification and App\Notifications\Ticket\User\ReplyNotification share the same unsafe rendering pattern, making the flaw symmetric across user→admin and admin→user notification flows.

RemediationAI

Vendor-released patch: upgrade to CtrlPanel 1.2.0 or later, available at https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0; this is a major release bundling 10 months of changes including a license shift to MPL 2.0, so review the release notes and blog post (https://ctrlpanel.gg/blog/1.2.0-release) before deploying to production. If an immediate upgrade is not possible, temporarily disable the ticket reply feature or restrict ticket creation to trusted users only, accepting the support-workflow disruption that implies; an interim hot-patch is to edit the two Blade notification templates to replace {!! $newmessage !!} with the escaped {{ $newmessage }} form, which preserves notifications while neutralizing HTML/JS injection at the rendering layer. Admins should also rotate session cookies and audit recent administrative actions on instances that were exposed prior to patching.