Junglewise Threat Intelligence

CVE-2026-6107: 1Panel-dev MaxKB stored XSS in ChatHeadersMiddleware

CVE-2026-6107 · Severity: low · CVSS 3.5 · Published 2026-04-12

Technologies: 1Panel-dev MaxKB. Vendors: 1Panel-dev.

Executive brief

MaxKB is an open-source platform used to build and manage AI-powered agents and knowledge bases. A security flaw allows an attacker with basic user permissions to inject malicious scripts into application names or icons. When other users or customers visit the chat interface associated with that application, the script executes in their browser, which could lead to unauthorized actions or the theft of session information.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in MaxKB versions up to 2.6.1. The flaw is located in 'apps/common/middleware/chat_headers_middleware.py' within the 'ChatHeadersMiddleware.process_response()' method. Authenticated attackers can inject malicious JavaScript into the 'name' or 'icon' fields via the '/api/application/' endpoint. Because the middleware performs direct string replacement into the HTML response without escaping these values, the payload executes when a victim accesses the public chat interface at '/ui/chat/{access_token}'. The issue was addressed in version 2.8.0 by implementing 'html.escape()' on the affected fields.

Affected products

  • 1Panel-dev MaxKB up to 2.6.1

Timeline

  • 2026-03-18: disclosed: Initial public report of the vulnerability
  • 2026-03-23: patched: Fix merged into the main repository
  • 2026-04-10: advisory: Official release of version 2.8.0 containing the fix
  • 2026-04-12: advisory: CVE-2026-6107 published

References