CVE-2026-41472 is a stored cross-site scripting vulnerability in CyberPanel before version 2.4.5. The issue exists in the AI Scanner dashboard's POST /api/ai-scanner/callback endpoint, which does not require authentication. Attackers can overwrite the findings_json field of ScanHistory records with malicious JavaScript. When an administrator views the AI Scanner dashboard, the script executes in their authenticated session, allowing same-origin requests that can plant cron jobs and lead to remote code execution on the server.

An unauthenticated attacker can inject malicious JavaScript that executes in an administrator's session, enabling them to perform actions with the administrator's privileges. This includes issuing same-origin requests to plant cron jobs, which can result in remote code execution on the server hosting CyberPanel. This elevates the risk from a client-side XSS to full server compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the AI Scanner dashboard and monitor for unauthorized POST requests to the /api/ai-scanner/callback endpoint. Consider implementing additional authentication or input validation controls to mitigate exploitation.