CVE-2026-41472: 
Cyberpanel vulnerability analysis and mitigation

CVE-2026-41472 is a stored cross-site scripting (XSS) vulnerability in CyberPanel's AI Scanner dashboard that can be chained to achieve unauthenticated remote code execution. The flaw affects all CyberPanel versions prior to 2.4.4 and was disclosed on April 24, 2026, with a patch released in version 2.4.4. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 5.3 (Medium), though its real-world impact is significantly higher due to the RCE chain (Github Advisory, Feedly).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically a stored XSS condition arising from the POST /api/ai-scanner/callback endpoint, which lacks any authentication check. An unauthenticated attacker can send a crafted POST request to this endpoint to overwrite the findings_json field of ScanHistory database records with arbitrary JavaScript. When an administrator subsequently visits the AI Scanner dashboard, the injected script executes within their authenticated browser session, enabling same-origin API calls to plant cron jobs and achieve server-side remote code execution. A public proof-of-concept demonstrating the exploit chain — including the specific endpoint path, parameter names, and JSON payload structure — is available at https://itsrez.re/post/cyberpanel-rce (Github Advisory, PoC Write-up).

Successful exploitation allows an unauthenticated remote attacker to ultimately execute arbitrary commands on the server with administrative privileges by chaining the stored XSS into cron job creation. The subsequent system impact includes high confidentiality and integrity compromise — attackers can exfiltrate sensitive data, modify hosted websites, pivot to other systems on the network, or establish persistent backdoors. Availability is not directly impacted by the XSS itself, but arbitrary code execution could be used to disrupt services (Github Advisory, Feedly).

A high-confidence proof-of-concept exploit with step-by-step instructions is publicly available at https://itsrez.re/post/cyberpanel-rce, demonstrating the full attack chain from unauthenticated XSS injection to RCE via cron job planting. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.15–0.29% (53rd percentile), and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory, Feedly).

1. Reconnaissance: Identify internet-facing CyberPanel instances running versions prior to 2.4.4 using tools like Shodan or Censys, searching for CyberPanel login pages or default ports.
2. Identify target scan record: Query or enumerate the AI Scanner dashboard to identify an existing ScanHistory record with a known scan_id, or trigger a new scan to create one.
3. Inject malicious payload: Send an unauthenticated HTTP POST request to /api/ai-scanner/callback with a JSON body containing the target scan_id and a malicious JavaScript payload in the findings_json field (e.g., {"scan_id": "<id>", "findings": "<script>/* malicious JS */</script>"}).
4. Wait for admin interaction: The injected script is now stored in the database. When an administrator visits the AI Scanner dashboard, the malicious JavaScript executes in their authenticated browser session.
5. Issue same-origin requests: The injected script uses the admin's session cookies to make authenticated API calls to CyberPanel's cron job management endpoints, creating a malicious cron job (e.g., a reverse shell command).
6. Achieve RCE: The planted cron job executes on the server at the scheduled interval, granting the attacker remote code execution with the privileges of the CyberPanel service account (PoC Write-up, Github Advisory).

• Network: Unauthenticated POST requests to /api/ai-scanner/callback from unexpected or external IP addresses; outbound connections from the CyberPanel server to unknown external hosts (potential reverse shell callbacks).
• Logs: CyberPanel access logs showing POST requests to /api/ai-scanner/callback without valid authentication tokens or session cookies; admin dashboard access logs showing visits to the AI Scanner page shortly before anomalous activity.
• File System: New or modified cron job entries in /etc/cron.d/, /var/spool/cron/, or user crontabs containing unexpected commands (e.g., reverse shell one-liners, wget/curl commands downloading scripts).
• Process: Unexpected child processes spawned by the CyberPanel web server process (e.g., bash, sh, python, nc, curl) executing commands not initiated by legitimate admin actions.
• Database: Modified findings_json fields in ScanHistory records containing <script> tags or encoded JavaScript payloads (PoC Write-up, Feedly).

The primary remediation is to upgrade CyberPanel to version 2.4.4 or later, which addresses the unauthenticated access to the /api/ai-scanner/callback endpoint (Github Advisory, Patch Commit). If immediate patching is not feasible, administrators should restrict network access to the CyberPanel management interface to trusted IP ranges only, disable the AI Scanner feature if it is not actively used, and implement a web application firewall (WAF) rule to block unauthenticated POST requests to /api/ai-scanner/callback. Additionally, monitor cron job creation and server processes for suspicious activity as a compensating control.

VulnCheck assigned and published the advisory for this CVE, providing a detailed description of the stored XSS-to-RCE chain (VulnCheck Advisory). A security researcher published a detailed technical write-up and proof-of-concept at itsrez.re, which was referenced by multiple vulnerability tracking platforms shortly after disclosure. The vulnerability received coverage from several security aggregators including InfinitSec and VulnDB, reflecting moderate community interest given the RCE potential despite the medium CVSS base score.