A vulnerability exists in the StaticHeadersMiddleware component of 1Panel‑dev MaxKB versions up to 2.2.1. The middleware fails to sanitize the Name argument, allowing attackers to inject malicious script payloads into HTTP responses. This cross‑site scripting flaw can execute arbitrary JavaScript in the victim's browser, potentially hijacking sessions, defacing user interfaces, or redirecting users to malicious sites. The weakness is characterized as an XSS flaw, aligned with CWE‑79 and also noted as a code injection issue.

1Panel‑dev MaxKB’s Public Chat Interface is affected, specifically the StaticHeadersMiddleware implementation. Versions up to 2.2.1 are vulnerable, while the patch is included in release 2.8.0. The vulnerability is confined to the component that processes chat messages and their metadata, so only installations exposing the public chat interface are at risk.

The CVSS score of 5.1 indicates moderate severity, and the attacker can exploit the flaw remotely by sending a crafted Name value to the chat endpoint. EPSS data is unavailable, but the vulnerability has an active public exploit as documented by the vendor and the community. Since the exploit is available and the issue is not listed in the CISA KEV catalog, organizations should treat the flaw with high operational urgency, prioritizing code remediation and monitoring for abuse.