A stored cross‑site scripting vulnerability allows an attacker to embed malicious JavaScript into the application name or icon fields when creating an application. The ChatHeadersMiddleware then retrieves this data and inserts it unescaped into the public chat page, causing the script to run in any visitor’s browser. The weakness is classified as CWE‑79 and can lead to session hijacking, data theft, and defacement of the web interface.

The issue affects the 1Panel‑dev MaxKB platform, specifically all releases version 2.7.1 and earlier. Version 2.8.0 releases the fix that properly escapes these fields.

The CVSS score of 6.9 indicates moderate severity. Exploitation requires the attacker to create or modify an application with malicious fields, and relies on a victim visiting the public chat URL with an access token. Because the vulnerability is stored and can be reused, any user who accesses the chat interface is at risk. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation yet.