High severity · published Sep 4, 2026
CVE-2026-85613
OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL. Attackers can host malicious SVG files with embedded scripts that execute in the victim's browser on the API origin, enabling same-origin credentialed requests to authenticated endpoints.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
openpanel · Openpanel-dev
before 2.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-85613
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-85613
vendor-advisory
https://github.com/Openpanel-dev/openpanel/security/advisories/GHSA-r7hx-q6f4-vj6h
third-party-advisory
https://www.vulncheck.com/advisories/openpanel-unauthenticated-xss-via-svg-favicon-proxy
More from openpanel
9.9
CVE-2026-93985
OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
8.8
CVE-2026-116811
OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
8.8
CVE-2026-85610
OpenPanel before 2.3.0 Remote Code Execution via chart formulas
8.6
CVE-2026-85614
OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker
8.5
CVE-2026-116819
OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query