CVE-2026-34246
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
CtrlPanel (open-source billing software for hosting providers) versions 1.1.1 and prior contain a stored XSS vulnerability in the admin role management interface. The datatable() method in RoleController.php interpolates role name and color directly into HTML without sanitization, and .rawColumns(['actions', 'name']) disables automatic escaping. An admin with role creation or edit permissions can inject malicious code that executes on every load of the /admin/roles page by any admin.
Risk Assessment
An attacker can hijack sessions of other admins, steal credentials, escalate privileges, or maintain persistent backdoors. This vulnerability allows full compromise of the admin panel.
Recommendation
Immediately upgrade CtrlPanel to version 1.2.0 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability exists in the admin role management interface. In app/Http/Controllers/Admin/RoleController.php, the datatable() method interpolates $role->name and $role->color directly into a <span> element's HTML and style attribute without sanitization, and the chained .rawColumns(['actions', 'name']) call instructs DataTables to render the name column as raw HTML, bypassing automatic output escaping. An admin with role creation or edit permissions can inject a payload such as <img src=x onerror="alert('XSS_POC')"> into the name or color fields, which is persisted to the database and executes in the browser of every admin who loads the /admin/roles page. This enables session hijacking via cookie theft, credential harvesting through fake login prompts or keyloggers, lateral privilege escalation by performing admin actions on behalf of victims, and a persistent backdoor that re-executes on every page load until the malicious role record is removed. This issue has been resolved in version 1.2.0.