What’s Vulnerable › Vulnerabilities

CVE-2026-85613: OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

• Severity: high (CVSS 8.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-04 · updated 2026-10-27
• Weakness: CWE-79

Description

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.

Affected products

• Openpanel-dev openpanel: before 2.3.0 — fixed in 2.3.0

How to fix

Upgrade to a fixed version: Openpanel-dev openpanel 2.3.0. Check the vendor advisory for mitigations.

References

• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r7hx-q6f4-vj6h
• https://www.vulncheck.com/advisories/openpanel-unauthenticated-xss-via-svg-favicon-proxy
• https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r7hx-q6f4-vj6h

Get alerted when CVE-2026-85613 or the next vulnerability affects your stack