Skip to main content

Maxkb CVE-2026-6107

| EUVDEUVD-2026-21688 MEDIUM
Cross-site Scripting (XSS) (CWE-79)
2026-04-12 VulDB
XSS Maxkb 1Panel Dev
5.1
CVSS 4.0 · NVD
Share

Severity by source

NVD PRIMARY
5.1 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
P
Scope
X

Lifecycle Timeline

7
Severity Changed
Apr 12, 2026 - 01:22 NVD
LOW MEDIUM
CVSS changed
Apr 12, 2026 - 01:22 NVD
3.5 (LOW) 5.1 (MEDIUM)
Analysis Generated
Apr 12, 2026 - 01:17 vuln.today
EUVD ID Assigned
Apr 12, 2026 - 01:15 euvd
EUVD-2026-21688
Analysis Generated
Apr 12, 2026 - 01:15 vuln.today
Patch released
Apr 12, 2026 - 01:15 nvd
Patch available
CVE Published
Apr 12, 2026 - 00:45 nvd
MEDIUM 5.1

DescriptionCVE.org

A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py of the component ChatHeadersMiddleware. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. Upgrading to version 2.8.0 is capable of addressing this issue. Patch name: 026a2d623e2aa5efa67c4834651e79d5d7cab1da. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

AnalysisAI

Stored cross-site scripting (XSS) in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to inject malicious scripts via the Name argument in ChatHeadersMiddleware, requiring user interaction to trigger. The vulnerability has a low CVSS score (3.5) due to requiring authentication and user interaction, but XSS can lead to session hijacking or credential theft. Vendor-released patch version 2.8.0 addresses this issue.

Technical ContextAI

The vulnerability exists in the ChatHeadersMiddleware component (apps/common/middleware/chat_headers_middleware.py) of MaxKB, a knowledge base management system. The root cause is improper input validation and output encoding of the Name parameter, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The middleware fails to sanitize user-supplied input before rendering it in HTTP responses, allowing attackers to inject arbitrary JavaScript code. When the parameter is reflected or stored without proper HTML encoding, subsequent requests or page views execute the injected script in the context of other users' browsers.

RemediationAI

Vendor-released patch: upgrade MaxKB to version 2.8.0 or later. The patch is available via the official GitHub repository at https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0. The fix corresponds to commit 026a2d623e2aa5efa67c4834651e79d5d7cab1da. Organizations unable to immediately upgrade should implement input validation and output encoding controls in the ChatHeadersMiddleware to neutralize special characters in the Name parameter, though immediate patching is the recommended approach given the straightforward availability of version 2.8.0.

More in Maxkb

View all
CVE-2025-48950 HIGH POC
8.8 Jun 03

MaxKB prior to version 1.10.8-lts contains an incomplete sandbox implementation that only blacklists binary execution in
CVE-2026-56779 MEDIUM POC
5.3 Jun 25

Server-side request forgery in MaxKB before 2.10.0 allows any authenticated user holding the default workspace USER role
CVE-2026-54149 HIGH
8.8 Jul 10

OS command injection in MaxKB (1Panel-dev's open-source enterprise AI assistant) before 2.10.0-lts lets an authenticated
CVE-2026-44847 HIGH
7.5 May 26

Authentication bypass in MaxKB (1Panel-dev) versions prior to 2.9.0 allows remote unauthenticated attackers to invoke we
CVE-2026-39423 MEDIUM
6.9 Apr 14

Stored Cross-Site Scripting (XSS) via Eval Injection in MaxKB's Markdown rendering engine allows authenticated users to

CVE-2026-39422 MEDIUM
6.9 Apr 14

Stored Cross-Site Scripting (XSS) in MaxKB 2.7.1 and below allows authenticated users to inject malicious JavaScript thr
CVE-2026-45413 MEDIUM
6.9 May 26

MaxKB, an open-source enterprise AI assistant by 1Panel-dev, stores user passwords as unsalted MD5 hashes, exposing all

CVE-2026-39420 MEDIUM
6.3 Apr 14

MaxKB versions 2.7.1 and below allow authenticated users with tool execution privileges to bypass the LD_PRELOAD-based s
CVE-2026-39421 MEDIUM
6.3 Apr 14

MaxKB versions 2.7.1 and below allow authenticated attackers with workspace privileges to execute arbitrary code by expl
CVE-2026-42335 MEDIUM
6.3 May 26

Server-side request forgery in MaxKB v2.8.0 and earlier allows authenticated low-privilege users to reach internal netwo
CVE-2026-45412 MEDIUM
6.3 May 26

Server-Side Request Forgery in MaxKB before 2.9.1 allows authenticated users to pivot into internal network infrastructu
CVE-2026-6108 LOW POC
2.1 Apr 12

OS command injection in 1Panel-dev MaxKB up to version 2.6.1 allows authenticated remote attackers to execute arbitrary

Same weakness CWE-79 – Cross-site Scripting (XSS)

View all
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2016-8581 MEDIUM POC
6.1
CVE-2013-5223 MEDIUM POC
5.4
CVE-2025-52367 MEDIUM POC
5.4

Same technique XSS

View all
CVE-2017-9248 CRITICAL POC
9.8
CVE-2020-3580 MEDIUM POC
6.1
CVE-2013-1710 CRITICAL POC
10.0
CVE-2013-7389 MEDIUM POC
4.3
CVE-2021-25299 MEDIUM POC
6.1
CVE-2014-2120 MEDIUM
6.1
CVE-2023-40000 HIGH POC
8.3
CVE-2024-52875 HIGH POC
8.8

Share

CVE-2026-6107 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy