This vulnerability is a classic reflected cross‑site scripting flaw located in OpenPanel’s public favicon proxy endpoint. By supplying a URL to an SVG file that contains embedded JavaScript, an unauthenticated attacker can get the server to fetch the SVG, embed it into a response, and cause the victim’s browser to execute the script. Because the script runs under the API origin, it can make additional requests that include the victim’s session cookies, enabling the attacker to steal session state or call any authenticated endpoint the user has access to. The flaw leverages an existing open endpoint that was never intended to receive externally supplied SVGs. The endpoint accepts the SVG URL as a query parameter and proxies the content without sanitizing or validating the payload. The attacker’s SVG can contain malicious JavaScript that runs in the context of the OpenPanel domain. Although the EPSS score is not available and the flaw is not listed in the CISA KEV catalog, the CVSS score of 8.4 indicates a high severity. Any user with an active authenticated session who visits a page that renders the favicon will be vulnerable. Attackers can host the malicious SVG on any remote server, making exploitation simple and inexpensive.

OpenPanel, developed by Openpanel-dev, is the affected product. The vulnerability exists in all versions prior to 2.3.0. Clients running OpenPanel 2.2.x or earlier are therefore vulnerable until an update that removes the faulty favicon proxy endpoint is applied.

Remote attackers can exploit this flaw by hosting a malicious SVG file and directing the unauthenticated favicon proxy endpoint at it. The proxy fetches the file, wraps it in a response that the victim’s browser receives with the OpenPanel origin, and any embedded JavaScript runs with the victim’s cookies. Because the script runs under the API domain, it can make authenticated requests on behalf of the user, effectively impersonating that user or exfiltrating data. With a CVSS score of 8.4, the risk is severe, and the absence of an EPSS score or KEV listing does not diminish the exposure; a single visiting user with an active session is in the critical state space.