CVE-2026-41472: CyberPanel < 2.4.4 Stored XSS via AI Scanner Dashboard
CyberPanel versions prior to 2.4.4 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to inject malicious JavaScript by overwriting the findingsjson field of ScanHistory records. Attackers can inject JavaScript that executes in an administrator's authenticated session when they visit the AI Scanner dashboard, allowing them to issue same-origin requests to plant cron jobs and achieve remote code execution on the server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CyberPanelto a version that resolves this vulnerability.Fixed in 2.4.4 - Compensating control
Until upgraded, restrict access to the AI Scanner dashboard and the POST /api/ai-scanner/callback endpoint so it is reachable only by authenticated/authorized administrators (because the endpoint lacks authentication and enables unauthenticated JavaScript injection via the findings_json field of ScanHistory records).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41472?
CVE-2026-41472 is rated as a high severity stored cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-41472?
To fix CVE-2026-41472, upgrade CyberPanel to version 2.4.4 or later.
What systems are affected by CVE-2026-41472?
CVE-2026-41472 affects CyberPanel versions prior to 2.4.4.
What type of vulnerability is CVE-2026-41472?
CVE-2026-41472 is a stored cross-site scripting (XSS) vulnerability.
Can CVE-2026-41472 be exploited remotely?
Yes, CVE-2026-41472 can be exploited remotely due to the lack of authentication in the affected endpoint.