CVE-2026-85613

Name of the Vulnerable Software and Affected Versions OpenPanel versions prior to 2.3.0

Description An issue exists in the unauthenticated favicon proxy endpoint 'GET /misc/favicon' that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files containing embedded scripts that execute in the victim's browser on the API origin, which enables same-origin credentialed requests to authenticated endpoints. Cross-site scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 2.3.0 or later. As a temporary workaround, restrict access to the 'GET /misc/favicon' endpoint to minimize the risk of exploitation.