# CVE-2026-10567: 1Panel-dev CordysCRM stored XSS in ModuleFormController

Source: https://junglewise.ai/threats/cve-2026-10567-1panel-dev-cordyscrm-stored-xss-in-moduleformcontroller  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-10567 · Severity: low · CVSS 3.5 · Published 2026-06-02

1Panel-dev CordysCRM, an open-source AI-driven Customer Relationship Management (CRM) system, is vulnerable to a security flaw in its form management component. An attacker with basic user privileges can inject malicious scripts into form descriptions. If another user or administrator views the affected form, the script could execute in their browser, potentially leading to unauthorized actions or data theft within the CRM environment.

Technologies: [1Panel-dev 1Panel](https://junglewise.ai/threats/technologies/1panel). Vendors: [1Panel-dev](https://junglewise.ai/threats/vendors/1panel-dev).

## Quick answers

**Is CVE-2026-10567 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10567 being exploited in the wild.

**How severe is CVE-2026-10567?** Low severity, with a CVSS score of 3.5, published 2 June 2026.

**Which products and versions are affected?** 1Panel-dev 1Panel up to 1.4.1.

**Is there a fix for CVE-2026-10567?** A patch was published on 2026-05-22: Fix committed to main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10567 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10567?** Check whether you run 1Panel-dev 1Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in CordysCRM versions up to 1.4.1. The root cause is a failure to sanitize or encode the 'Description' argument within the save() method of ModuleFormController (specifically in ModuleFormService.java). A remote attacker with low privileges can submit a crafted payload to the /module/form/save endpoint. When an administrative user accesses the backend form settings or tracking records, the malicious script executes in their browser context. This issue is addressed in version 1.7.0, which introduces configurable XSS protection and URL filtering.

## Affected products

- 1Panel-dev CordysCRM up to 1.4.1

## Timeline

- 2026-05-14: other: Vulnerability reported via GitHub issue
- 2026-05-22: patched: Fix committed to main branch
- 2026-05-29: other: Version 1.7.0 released
- 2026-06-02: disclosed: CVE published

## References

- [https://github.com/1Panel-dev/CordysCRM/](https://github.com/1Panel-dev/CordysCRM/)
- [https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce](https://github.com/1Panel-dev/CordysCRM/commit/c87682afa8df79853299f75489c9d333f7bc5fce)
- [https://github.com/1Panel-dev/CordysCRM/issues/2233](https://github.com/1Panel-dev/CordysCRM/issues/2233)
- [https://github.com/1Panel-dev/CordysCRM/pull/2356](https://github.com/1Panel-dev/CordysCRM/pull/2356)
- [https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0](https://github.com/1Panel-dev/CordysCRM/releases/tag/v1.7.0)
- [https://vuldb.com/cve/CVE-2026-10567](https://vuldb.com/cve/CVE-2026-10567)
- [https://vuldb.com/submit/829316](https://vuldb.com/submit/829316)

## Related threats

- [1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint](https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint)
- [1Panel-dev CordysCRM SSRF in TokenService via mkAddress](https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress)
- [1Panel command injection in container log search API](https://junglewise.ai/threats/cve-2024-34352-1panel-command-injection-in-container-log-search-api)