CVE-2026-41472 is a stored cross-site scripting vulnerability in usmannasir CyberPanel versions prior to 2.4.4. The issue arises because the POST /api/ai-scanner/callback endpoint does not require authentication and allows unauthenticated users to overwrite the findings_json field in ScanHistory records with malicious JavaScript. This script executes in the context of an administrator's session when they access the AI Scanner dashboard, enabling same-origin requests that can be used to plant cron jobs and achieve remote code execution on the server. The vulnerability is classified under CWE-79 and has a CVSS 4.0 base score of 5.3 (medium severity). There is no vendor advisory or patch currently available, and the product is not a cloud service, so remediation depends on vendor updates or user mitigation.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary JavaScript in an administrator's session via the AI Scanner dashboard. This can lead to unauthorized actions such as planting cron jobs, which may result in remote code execution on the server hosting CyberPanel. The vulnerability compromises administrative control and server integrity. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the AI Scanner dashboard and monitor for suspicious activity. Consider implementing web application firewall (WAF) rules to block unauthorized POST requests to /api/ai-scanner/callback. Avoid using vulnerable versions of CyberPanel in untrusted environments.