CVE-2026-6106: 1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting
A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/staticheadersmiddleware.py of the component Public Chat Interface. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 2.8.0 is able to resolve this issue. The patch is identified as 026a2d623e2aa5efa67c4834651e79d5d7cab1da. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
1Panel-dev MaxKB Public Chat (StaticHeadersMiddleware in apps/common/middleware/static_headers_middleware.py)to a version that resolves this vulnerability.Fixed in 2.8.0Patch 026a2d623e2aa5efa67c4834651e79d5d7cab1da
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6106?
CVE-2026-6106 is classified as a medium severity vulnerability.
How do I fix CVE-2026-6106?
To fix CVE-2026-6106, update 1Panel-dev MaxKB to version 2.2.2 or later.
What does CVE-2026-6106 affect?
CVE-2026-6106 affects the StaticHeadersMiddleware function in the apps/common/middleware/static_headers_middleware.py file.
Can CVE-2026-6106 lead to cross-site scripting attacks?
Yes, CVE-2026-6106 can allow attackers to perform cross-site scripting (XSS) attacks.
Which versions of 1Panel-dev MaxKB are impacted by CVE-2026-6106?
Versions of 1Panel-dev MaxKB up to and including 2.2.1 are impacted by CVE-2026-6106.