Executive brief
CtrlPanel, an open-source billing platform for hosting providers, contains a security flaw in its support ticket notification system. An attacker can send a malicious ticket reply that, when viewed by an administrator or another user, executes unauthorized code in their browser. This can lead to the theft of administrator sessions, account takeovers, and unauthorized changes to the hosting environment.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in CtrlPanel <= 1.1.1 due to improper sanitization of ticket reply content ($newmessage). The application stores raw reply data in database notification payloads and subsequently renders it unescaped using Blade's {!! !!} syntax. The flaw affects both AdminReplyNotification and UserReplyNotification classes. A low-privileged attacker can inject malicious JavaScript into a ticket reply; when an administrator views their notification feed, the script executes in their session context. This enables session hijacking, credential harvesting, and administrative privilege escalation. The issue is fixed in version 1.2.0 by implementing strip_tags() on notification content.
Affected products
- CtrlPanel-gg CtrlPanel <= 1.1.1
Timeline
- 2026-04-24: patched: Version 1.2.0 released
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: CVE published to NVD