CVE-2026-85613

OpenPanel before 2.3.0 contains a cross-site scripting (XSS) flaw in its unauthenticated favicon proxy endpoint, GET /misc/favicon. An attacker can trigger it by getting a user to load a crafted request in which the endpoint fetches an attacker-hosted SVG file with embedded script; because user interaction is required, this typically means luring a logged-in panel user to a malicious link. The injected script executes on the panel's API origin, letting the attacker issue same-origin, credentialed requests against authenticated endpoints and effectively act as the victim (e.g., reading or changing panel settings as an admin). Any deployment running OpenPanel versions prior to 2.3.0 is affected, including internet-exposed and internal panel instances. There is no public proof-of-concept, the issue is not in CISA KEV, and EPSS puts near-term exploitation probability at roughly 0.2%, so no in-the-wild exploitation is currently known.

What to do: Upgrade OpenPanel to version 2.3.0 or later. As an interim mitigation, restrict or sanitize the GET /misc/favicon proxy so it only fetches trusted URLs or cannot return SVG/script content, or apply a WAF rule limiting external fetches from that path. Review access logs for requests to /misc/favicon referencing external SVG URLs to check whether the endpoint has been probed or abused.