1Panel-dev MaxKB MdPreview chat.ts cross site scripting

Successful exploitation of CVE-2025-15632 allows an attacker to inject arbitrary JavaScript code into the 1Panel-dev MaxKB application. This can be leveraged to steal user session cookies, redirect users to malicious websites, or modify the content displayed within the application. The impact is particularly concerning given that the vulnerability is remotely exploitable, meaning an attacker does not need to be authenticated to launch an attack. The attack targets the MdPreview component within the ui/src/chat.ts file, suggesting a potential weakness in how user input is handled and sanitized within the chat functionality.

Organizations using 1Panel-dev MaxKB in production environments, particularly those with publicly accessible chat functionality, are at risk. Shared hosting environments where multiple users share the same 1Panel-dev MaxKB instance are also at increased risk, as an attacker could potentially compromise other users through this vulnerability.

• javascript / web: Examine the ui/src/chat.ts file for improper input sanitization or output encoding. Look for instances where user-supplied data is directly inserted into the DOM without proper escaping. • generic web: Monitor access logs for suspicious requests containing JavaScript payloads targeting the chat functionality. • generic web: Use a browser developer console to test for XSS vulnerabilities by injecting simple payloads into the chat input field.

1. 2026-04-13Disclosure

   disclosure

1. Réservé2026-04-11
2. Publiée2026-04-13
3. EPSS mis à jour2026-04-20

The primary mitigation for CVE-2025-15632 is to upgrade 1Panel-dev MaxKB to version 2.5.0 or later, which includes the fix (patch 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8). If immediate upgrading is not possible, consider implementing input validation and output encoding on the affected component (MdPreview) to prevent the injection of malicious scripts. While a WAF might offer some protection, it's not a substitute for patching. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the chat functionality and verifying that it does not execute.