What is the CVSS score of CVE-2026-34246?

CVE-2026-34246 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34246?

Yes, a patch is available for CVE-2026-34246. Update the affected software to the latest version immediately.

CtrlPanel CVE-2026-34246

EUVD-2026-30986 MEDIUM

Basic XSS (CWE-80)

2026-05-19 GitHub_M

PHP XSS Privilege Escalation

4.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.8 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

May 19, 2026 - 22:02 EUVD

Source Code Evidence Fetched

May 19, 2026 - 22:01 vuln.today

Analysis Generated

May 19, 2026 - 22:01 vuln.today

DescriptionGitHub Advisory

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role management interface. In app/Http/Controllers/Admin/RoleController.php, the datatable() method interpolates $role->name and $role->color directly into a <span> element's HTML and style attribute without sanitization, and the chained .rawColumns(['actions', 'name']) call instructs DataTables to render the name column as raw HTML, bypassing automatic output escaping. An admin with role creation or edit permissions can inject a payload such as <img src=x onerror="alert('XSS_POC')"> into the name or color fields, which is persisted to the database and executes in the browser of every admin who loads the /admin/roles page. This enables session hijacking via cookie theft, credential harvesting through fake login prompts or keyloggers, lateral privilege escalation by performing admin actions on behalf of victims, and a persistent backdoor that re-executes on every page load until the malicious role record is removed. This issue has been resolved in version 1.2.0.

AnalysisAI

Stored XSS in CtrlPanel's admin role management interface (versions 1.1.1 and prior) allows a privileged admin to inject persistent malicious HTML into role name or color fields, which executes in the browser of every admin who subsequently loads the /admin/roles page. The attack enables session hijacking, credential harvesting via fake login prompts or keyloggers, and lateral privilege escalation by performing admin actions on behalf of victim admins - with the payload re-executing on every page load until the offending role record is manually deleted. No active exploitation is confirmed (not in CISA KEV), but a proof-of-concept payload is documented in the vendor advisory. Fixed in version 1.2.0.

Technical ContextAI

CtrlPanel is a PHP/Laravel-based open-source billing panel for hosting providers (CPE: cpe:2.3:a:ctrlpanel-gg:panel). The vulnerability originates in app/Http/Controllers/Admin/RoleController.php, where the datatable() method constructs HTML strings by directly interpolating $role->name and $role->color without sanitization. Critically, the chained .rawColumns(['actions', 'name']) call explicitly instructs the Laravel DataTables library to bypass its default output escaping for the name column, treating user-controlled database content as trusted raw HTML. Laravel's Blade templating engine normally escapes output via {{ }} syntax, but this server-side DataTables builder circumvents that protection by design - the developer explicitly opted into raw HTML rendering. The root cause class is CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page), a stored variant where the injection point is the database and the sink is the dynamically built DataTable response rendered in admin browsers.

RemediationAI

Upgrade to CtrlPanel version 1.2.0, which resolves this vulnerability per the official security advisory at https://github.com/Ctrlpanel-gg/panel/security/advisories/GHSA-wpqj-xwhq-2mmh and the release notes at https://github.com/Ctrlpanel-gg/panel/releases/tag/1.2.0. Version 1.2.0 is a major release that also includes significant bug fixes across credits, coupons, referrals, and server allocation logic. If immediate upgrade is not feasible, audit all existing role records in the database for suspicious HTML in the name and color fields (e.g., any values containing angle brackets, script tags, or event handler attributes) and remove or sanitize them - this is necessary even after patching if a payload was already injected. Additionally, restrict role creation and edit permissions to the minimum number of trusted admins to reduce the injection attack surface. Note that version 1.2.0 also includes a license change from AGPL 3.0 to Mozilla Public License 2.0, which may have procurement or compliance implications for organizations prior to upgrade.