PT-2026-32128

CVE-2026-6107

Published

2026-04-12

Updated

2026-04-12

Description by

CVSS 4.0

5.1

Medium

MetricsAV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X

Name of the Vulnerable Software and Affected Versions 1Panel-dev MaxKB versions up to 2.6.1

Description A flaw exists in the processing of the file apps/common/middleware/chat headers middleware.py within the ChatHeadersMiddleware component. Manipulation of the Name argument can lead to cross site scripting. Remote exploitation is possible.

Recommendations Upgrade to version 2.8.0 to address this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Ana10Gy

Vendors

Affected products

Weakness enumeration

CWE-94: Improper Control of Generation of Code (\'Code Injection\')

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')