Executive brief
CtrlPanel is an open-source billing and management platform for hosting providers. A security flaw in the administrative role management interface allows an authorized administrator to inject malicious scripts into the system. If another administrator views the roles list, these scripts could execute in their browser, potentially leading to session hijacking, unauthorized data access, or the performance of administrative actions without their consent.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in CtrlPanel versions 1.1.1 and prior within the `datatable()` method of `app/Http/Controllers/Admin/RoleController.php`. The application interpolates `$role->name` and `$role->color` directly into a `<span>` element's HTML and style attributes without sanitization. Furthermore, the use of `.rawColumns(['actions', 'name'])` instructs the DataTables component to render the output as raw HTML, bypassing automatic escaping. An attacker with administrative privileges to create or edit roles can inject a malicious payload (e.g., `<img src=x onerror="...">`) that persists in the database and executes in the browser of any administrator who visits the `/admin/roles` page. This issue is resolved in version 1.2.0.
Affected products
- Ctrlpanel-gg CtrlPanel <= 1.1.1
Timeline
- 2026-04-24: patched: Version 1.2.0 released
- 2026-05-08: advisory: GitHub Security Advisory published
- 2026-05-19: disclosed: CVE published to NVD