CVE-2026-85613

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-85613

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85613.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-85613

Aliases

GHSA-r7hx-q6f4-vj6h

Published

2026-09-04T11:30:08Z

Modified

2026-10-03T03:46:59Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N CVSS Calculator

Summary

OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

Details

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/85xxx/CVE-2026-85613.json"
}

References

Affected packages

Git / github.com/openpanel-dev/openpanel

Affected ranges

Type

GIT

Repo

https://github.com/openpanel-dev/openpanel

Events

Introduced

Fixed

cd24bb838301df1a9087e2e132b344e5b8a99963

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-85613.json"