CVE-2026-41472 is a stored cross-site scripting vulnerability in usmannasir's CyberPanel prior to version 2.4.4. The vulnerability exists because the POST /api/ai-scanner/callback endpoint lacks authentication and allows unauthenticated attackers to overwrite the findings_json field in ScanHistory records with malicious JavaScript. This script executes in the context of an administrator's session when they access the AI Scanner dashboard, enabling same-origin requests that can be leveraged to plant cron jobs and achieve remote code execution on the server. The CVSS 4.0 vector indicates network attack vector, low attack complexity, partial attack traceability, no privileges required, and high scope impact.

Successful exploitation allows unauthenticated attackers to inject persistent malicious JavaScript that executes in an administrator's session. This can lead to unauthorized actions such as planting cron jobs on the server, resulting in remote code execution. The vulnerability compromises the confidentiality, integrity, and availability of the affected system. The CVSS score of 5.3 reflects a medium severity impact.

No official patch or remediation level has been published by the vendor as of now. Since the product is not a cloud service, users should monitor the vendor's advisory channels for updates and apply any forthcoming patches promptly. Until a fix is available, restrict access to the AI Scanner dashboard and consider implementing web application firewalls or input validation controls to mitigate injection risks. Avoid exposing the vulnerable endpoint to untrusted networks.