1Panel is an open‑source web‑based control panel for Linux servers that offers an App Store for installing applications. A stored Cross‑Site Scripting vulnerability exists in the App Store when viewing application details. The flaw arises from insufficient sanitization of content rendered by the MdEditor component with previewOnly mode enabled. An attacker can embed arbitrary scripts into the README of a malicious application; when a logged‑in user views the details, the scripts execute in the victim’s browser context. The result is the theft of session cookies and potentially unauthorized access to system functions, thereby compromising confidentiality, integrity, and availability. The likely attack vector is inferred as a malicious application published to the App Store, which the vulnerability does not explicitly state but is derived from the description.

All supported releases of 1Panel up to and including v1.10.33‑lts and v2.0.16 are affected. The vendor supplied patched releases are v1.10.34‑lts and v2.0.17.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1% demonstrates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread attacks have been observed. Exploitation would require a malicious application to be published to the App Store and subsequently viewed by a logged‑in user; this is inferred from the description. Successful exploitation would allow an attacker to steal credentials or perform privileged actions from the victim’s browser session.