CVE-2026-41472 is a stored cross-site scripting vulnerability in CyberPanel before version 2.4.4. The vulnerability exists because the POST /api/ai-scanner/callback endpoint does not require authentication, allowing attackers to overwrite the findings_json field in ScanHistory records with malicious JavaScript. When an administrator views the AI Scanner dashboard, the injected script executes in their authenticated session, permitting same-origin requests that can be leveraged to plant cron jobs and achieve remote code execution on the server.

An unauthenticated attacker can inject malicious JavaScript that executes in an administrator's session, potentially allowing the attacker to perform actions with the administrator's privileges. This includes issuing same-origin requests to plant cron jobs, which can lead to remote code execution on the server hosting CyberPanel. The vulnerability thus enables unauthorized remote code execution via a stored XSS attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is indicated in the available data, users should monitor the vendor's communications for updates. In the meantime, restricting access to the affected endpoint and limiting administrative dashboard access may reduce exposure.