CVE-2026-6106 | THREATINT – Canadian Cyber Watch

Description

A vulnerability was detected in 1Panel-dev MaxKB up to 2.2.1. This vulnerability affects the function StaticHeadersMiddleware of the file apps/common/middleware/static_headers_middleware.py of the component Public Chat Interface. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used. Upgrading to version 2.8.0 is able to resolve this issue. The patch is identified as 026a2d623e2aa5efa67c4834651e79d5d7cab1da. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

PUBLISHED Reserved 2026-04-11 | Published 2026-04-11 | Updated 2026-04-11 | Assigner VulDB

MEDIUM: 5.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P

LOW: 3.5CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

LOW: 3.5CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C

4.0AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C

Problem types

Cross Site Scripting

Code Injection

Product status

2.2.0
affected

2.2.1
affected

2.8.0
unaffected

Timeline

2026-04-11:	Advisory disclosed
2026-04-11:	VulDB entry created
2026-04-11:	VulDB entry last update

Credits

Ana10gy (VulDB User) reporter

VulDB CNA Team coordinator

References

vuldb.com/vuln/356965 (VDB-356965 | 1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting) vdb-entry technical-description

vuldb.com/vuln/356965/cti (VDB-356965 | CTI Indicators (IOB, IOC, TTP, IOA)) signature permissions-required

vuldb.com/submit/781810 (Submit #781810 | 1Panel-dev MaxKB <= v2.2.1 Stored XSS) third-party-advisory

github.com/AnalogyC0de/public_exp/issues/23 exploit issue-tracking

github.com/1Panel-dev/MaxKB/pull/4919 issue-tracking patch

github.com/…ommit/026a2d623e2aa5efa67c4834651e79d5d7cab1da patch

github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0 patch

github.com/1Panel-dev/MaxKB/ product

cve.org (CVE-2026-6106)

nvd.nist.gov (CVE-2026-6106)

Download JSON

Source link