CtrlPanel-gg panel versions prior to 1.2.0 have a stored XSS vulnerability (CWE-79) in the ticket reply notification system. The issue arises because reply content ($newmessage) is stored unsanitized in the database and rendered unescaped using Blade's {!! !!} syntax in notifications sent to admins and users. This allows low-privileged attackers to execute arbitrary JavaScript in the context of victims' sessions, potentially hijacking admin sessions or compromising user accounts. The flaw affects both directions of communication between users and admins. The vulnerability is tracked as CVE-2026-34241 with a CVSS 3.1 score of 8.7 (high severity).

Successful exploitation allows arbitrary JavaScript execution in the victim’s browser session, leading to session hijacking, credential theft via fake login prompts or keyloggers, and privilege escalation through unauthorized administrative actions. Both admins and users can be targeted depending on the direction of the notification. This can compromise the confidentiality and integrity of user sessions and data within the CtrlPanel environment.

This vulnerability has been fixed in CtrlPanel version 1.2.0. Users should upgrade to version 1.2.0 or later to remediate this issue. Since the product is not a cloud service and no official patch link or advisory is provided, upgrading to the fixed version is the recommended action. Patch status is confirmed by the vendor stating the fix is included in version 1.2.0.