Executive brief
ISPConfig, a popular open-source hosting control panel used to manage web servers, is vulnerable to a security flaw in its system monitoring interface. An attacker could potentially execute malicious scripts in the browser of a logged-in administrator who visits a compromised link. This could lead to unauthorized actions being performed on the management console or the theft of sensitive session information.
Technical details
A reflected Cross-Site Scripting (XSS) vulnerability exists in ISPConfig 3.3.0 within the 'monitor' component of the system status webpage. The vulnerability arises from improper neutralization of user-supplied input during web page generation (CWE-79). While the NVD vector suggests no privileges are required, vendor documentation indicates the attack targets the monitor interface and typically requires a valid administrator session to be effective. An attacker can exploit this by tricking an authenticated user into clicking a specially crafted link, allowing the execution of arbitrary JavaScript in the context of the victim's session. The issue is addressed in version 3.3.0p2.
Affected products
- ISPConfig ISPConfig 3.3.0
Timeline
- 2026-05-05: advisory: Initial NVD publication
- 2026-05-05: patched: ISPConfig 3.3.0p2 released to address the issue