CVE-2026-34241: high-severity vulnerability in Ctrlpanel-gg panel
CtrlPanel: Stored XSS in Ticket Reply Notifications Allows Session Hijacking
Published · Updated
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.4%
exploitation probability
0.4%top 63% of all CVEs
observed exploitation
nono source reports it
CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contain a Stored Cross-Site Scripting (XSS) vulnerability in the ticket reply notification system. Unsanitized reply content ($newmessage) is stored directly in database notification payloads and later rendered unescaped via Blade's {!! !!} syntax in the recipient's browser. The flaw exists in both App\Notifications\Ticket\Admin\AdminReplyNotification (triggered when a user replies, targeting admins) and App\Notifications\Ticket\User\ReplyNotification (triggered when an admin replies, targeting users), allowing arbitrary JavaScript execution in the victim's session context. A low-privileged attacker can exploit this to hijack admin sessions, harvest credentials via fake login prompts or keyloggers, and escalate privileges by performing administrative actions on the victim's behalf. The reverse path also enables a malicious or compromised admin to target regular users in the same manner. This issue has been fixed in version 1.2.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Affected products
Ctrlpanel-gg · panelRelated CVEs — Ctrlpanel-gg panel
In the same product, most dangerous first.
CVE-2026-34234CRITICALCtrlPanel: Unauthenticated RCE using installer scriptEPSS 4.5%CVE-2026-34216MEDIUMCtrlPanel: Authenticated Remote Code Execution via Dynamic Class Instantiation in SettingsController.phpEPSS 0.7%CVE-2025-25203HIGHCtrlpanel has stored XSS vulnerability in TicketsController priority fieldEPSS 0.4%CVE-2026-34358HIGHCtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC BypassEPSS 0.4%CVE-2026-34233MEDIUMCtrlPanel has Missing Authentication Checks in Datatable Admin EndpointsEPSS 0.4%CVE-2026-34246MEDIUMCtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML OutputEPSS 0.3%