CVE-2026-34246

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in CtrlPanel versions 1.1.1 and prior. In app/Http/Controllers/Admin/RoleController.php, the datatable() method constructs an HTML string by directly interpolating $role->name and $role->color into a ` element without escaping. The chained .rawColumns(['actions', 'name']) call instructs DataTables to render the name column as raw HTML, bypassing automatic output escaping. This allows an admin with role creation or edit permissions to inject arbitrary JavaScript into the name or color fields, which is persisted to the database and executed when any admin loads the /admin/roles` page [1][2].

Exploitation

An attacker must be authenticated as an admin with permissions to create or edit roles. The attacker navigates to the role creation or edit form, then enters a payload such as ` into the Name field (or a similar payload into the Color field). After saving the role, every admin who visits Admin → Roles (/admin/roles)` will have the payload executed in their browser session [2]. No further user interaction is required beyond loading the page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of all other admins viewing the roles list. This enables session hijacking via cookie theft, credential harvesting through fake login prompts or keyloggers, lateral privilege escalation by performing admin actions on behalf of victims, and a persistent backdoor that re-executes on every page load until the malicious role record is removed [2].

Mitigation

The vulnerability is fixed in CtrlPanel version 1.2.0, released on 2025-04-24 [1]. Administrators should upgrade to version 1.2.0 or later. As a workaround, if upgrading is not immediately possible, the advisory suggests disabling the role management interface or restricting role creation/edit permissions to highly trusted users until the upgrade can be applied [2].