Executive brief
OpenPanel is an open-source hosting control panel that exposes an unauthenticated favicon proxy endpoint. An attacker can host a malicious SVG file and trick users into loading it via the proxy, causing embedded JavaScript to execute in the user's browser with access to authenticated API endpoints. This allows attackers to make unauthorized requests to the dashboard and steal user data or perform actions on behalf of authenticated users.
Technical details
The vulnerability is a cross-site scripting (XSS) flaw in the unauthenticated GET /misc/favicon endpoint (apps/api/src/controllers/misc.controller.ts). The endpoint fetches and proxies favicons from attacker-supplied URLs. While non-SVG images are rasterized to PNG via Sharp (neutralizing embedded scripts), SVG files are returned verbatim without sanitization. The response is served inline as Content-Type: image/svg+xml with no Content-Security-Policy or X-Content-Type-Options header, allowing embedded SVG scripts to execute in the victim's browser. Since the API origin serves credentialed endpoints with CORS enabled, an attacker's script can issue same-origin requests to authenticated tRPC endpoints and steal session data or perform unauthorized actions. The attack requires user interaction (visiting a malicious link) but no authentication. The fix is available in version 2.3.0.
Affected products
- OpenPanel OpenPanel before 2.3.0
Timeline
- 2026-08-20: disclosed
- 2026-09-04: patched: Version 2.3.0 released