CVE-2026-85613: OpenPanel Unauthenticated XSS via SVG Favicon Proxy
OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenPanelto a version that resolves this vulnerability.Fixed in 2.3.0 - Compensating control
Restrict or block unauthenticated access to the favicon proxy endpoint GET /misc/favicon to prevent remote SVG URLs from being rendered via the vulnerable unauthenticated endpoint.
Event History
Frequently Asked Questions
Which deployments are affected?
OpenPanel versions before 2.3.0 are affected. The vulnerable endpoint is the unauthenticated GET /misc/favicon endpoint.
What does an attacker need to exploit this issue?
An attacker can remotely supply a URL to an attacker-hosted SVG file containing embedded script. Exploitation requires a victim to interact with the malicious content in their browser.
What is the impact if exploitation succeeds?
The embedded script executes on the OpenPanel API origin. This can enable same-origin, credentialed requests to authenticated endpoints, with high confidentiality impact and low integrity impact.