CVE-2026-6107

1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting

State: Published
Severity: 5.1 Medium
Published: Apr 12, 2026
Updated: Apr 15, 2026
Reserved: Apr 11, 2026

Description

A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py of the component ChatHeadersMiddleware. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. Upgrading to version 2.8.0 is capable of addressing this issue. Patch name: 026a2d623e2aa5efa67c4834651e79d5d7cab1da. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

Scores

CVSS	Score	Vector	Source
4.0	5.1 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X	VulDB
3.1	3.5 Low	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C	VulDB
3.0	3.5 Low	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:X/RL:O/RC:C	VulDB
2.0	4.0 Medium	AV:N/AC:L/Au:S/C:N/I:P/A:N/E:ND/RL:OF/RC:C	VulDB

Weaknesses

CWE-79 Cross Site Scripting
CWE-94 Code Injection

Affected Products

Product	Versions
MaxKB1Panel-dev	2.6.0Affected 2.6.1Affected 2.8.0Not affected

References

VDB-356966 | 1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scriptingvdb-entrytechnical-description
VDB-356966 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #782263 | 1Panel-dev MaxKB <= v2.6.1 Stored XSSthird-party-advisory
https://github.com/AnalogyC0de/public_exp/issues/24issue-tracking
https://github.com/1Panel-dev/MaxKB/pull/4919issue-trackingpatch
https://github.com/1Panel-dev/MaxKB/commit/026a2d623e2aa5efa67c4834651e79d5d7cab1dapatch
https://github.com/1Panel-dev/MaxKB/releases/tag/v2.8.0patch
https://github.com/1Panel-dev/MaxKB/product

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.