CVE-2026-85613
HIGH
MEDIUM
Priority: 0.03
BB Relevance:
67/100
Published: 2026-09-04
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Auth
Conf. Impact
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Passive
AT:
None
VC:
High
VI:
Low
VA:
None
Description
OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.