CVE-2026-6107CWE-79CWE-94

1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting

Medium · published April 12, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chat_headers_middleware.py of the component ChatHeadersMiddleware. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the attack is possible. Upgrading to version 2.8.0 is capable of addressing this issue. Patch name: 026a2d623e2aa5efa67c4834651e79d5d7cab1da. Upgrading the affected component is advised. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X
EPSS
0.00365 · 29.1th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-04-12T00:45Z
EPSS history
Timeline
  • 12 APR 00:45Z
    1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting
    cvelistv5