CVE-2026-23525

CVE-2026-23525 affects 1Panel App Store with stored XSS due to insufficient sanitization in MdEditor when previewOnly is enabled. Impacted versions: 1Panel up to v1.10.33-lts and v2.0.16; attacker could publish a malicious app that executes scripts when loaded locally/remotely, potentially steali...

CVE-2026-23525 1panel App Store vulnerable to Cross-site Scripting

1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting XSS vulnerability exists in the 1Panel App Store when viewing application details. Malicious scripts can execute in the context of the user’s browser, potentially compromising session data...