Junglewise Threat Intelligence

CVE-2026-10567: 1Panel-dev CordysCRM stored XSS in ModuleFormController

CVE-2026-10567 · Severity: low · CVSS 3.5 · Published 2026-06-02

Technologies: 1Panel-dev CordysCRM, 1Panel-dev 1Panel. Vendors: 1Panel-dev.

Executive brief

1Panel-dev CordysCRM, an open-source AI-driven Customer Relationship Management (CRM) system, is vulnerable to a security flaw in its form management component. An attacker with basic user privileges can inject malicious scripts into form descriptions. If another user or administrator views the affected form, the script could execute in their browser, potentially leading to unauthorized actions or data theft within the CRM environment.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in CordysCRM versions up to 1.4.1. The root cause is a failure to sanitize or encode the 'Description' argument within the save() method of ModuleFormController (specifically in ModuleFormService.java). A remote attacker with low privileges can submit a crafted payload to the /module/form/save endpoint. When an administrative user accesses the backend form settings or tracking records, the malicious script executes in their browser context. This issue is addressed in version 1.7.0, which introduces configurable XSS protection and URL filtering.

Affected products

  • 1Panel-dev CordysCRM up to 1.4.1

Timeline

  • 2026-05-14: other: Vulnerability reported via GitHub issue
  • 2026-05-22: patched: Fix committed to main branch
  • 2026-05-29: other: Version 1.7.0 released
  • 2026-06-02: disclosed: CVE published

References

Related threats