CVE-2026-85613: OpenPanel XSS Vulnerability in Favicon Proxy

CVE-2026-85613 Overview

CVE-2026-85613 is a cross-site scripting (XSS) vulnerability in OpenPanel versions before 2.3.0. The flaw resides in the unauthenticated favicon proxy endpoint GET /misc/favicon, which fetches remote resources without validating their content type. Attackers can host a malicious Scalable Vector Graphics (SVG) file containing embedded JavaScript and coerce a victim to request it through the proxy. The response executes in the victim's browser on the OpenPanel API origin, granting the attacker same-origin access to authenticated endpoints. The vulnerability is tracked under [CWE-79] and stems from missing output sanitization on proxied content.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the OpenPanel origin context, enabling credentialed requests against authenticated administrative endpoints.

Affected Products

OpenPanel versions prior to 2.3.0
OpenPanel /misc/favicon proxy endpoint
Deployments exposing the OpenPanel API to untrusted networks

Discovery Timeline

2026-09-04 - CVE-2026-85613 published to the National Vulnerability Database (NVD)
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85613

Vulnerability Analysis

OpenPanel exposes an unauthenticated favicon proxy at GET /misc/favicon that accepts a target URL and returns the fetched resource to the client. The endpoint relays remote content without enforcing an image-only content type or stripping active markup. When an attacker supplies a URL pointing to an SVG file, the browser interprets the response as XML and executes any <script> elements or event handlers embedded in the SVG. Because the response is served from the OpenPanel origin, the executing script inherits full same-origin privileges. It can issue credentialed fetch requests against authenticated administrative APIs, exfiltrate session data, or pivot to server-side actions available to the victim's session. User interaction is required, since a victim must load the crafted URL, typically through a phishing link or an attacker-controlled page that embeds the proxy request.

Root Cause

The root cause is missing content-type enforcement and output sanitization on proxied favicon data. The endpoint trusts the remote server's response body and forwards SVG payloads with a MIME type that browsers render as active content. See the GitHub Security Advisory and the VulnCheck Advisory for XSS for vendor detail.

Attack Vector

The attack requires no authentication but does require user interaction. An attacker hosts a malicious SVG on infrastructure they control, then constructs a URL such as https://target/misc/favicon?url=https://attacker.example/x.svg. When a signed-in OpenPanel user visits the crafted link, the browser renders the SVG on the OpenPanel origin and executes the embedded script with access to the victim's session cookies and stored tokens.

Detection Methods for CVE-2026-85613

Indicators of Compromise

Requests to /misc/favicon where the url parameter references .svg files or non-image extensions.
Outbound fetches from OpenPanel servers to unfamiliar external hosts triggered by favicon proxy requests.
Response bodies from /misc/favicon returning image/svg+xml or containing <script> markup.

Detection Strategies

Inspect web server and reverse-proxy logs for high volumes of /misc/favicon requests from single client IPs or unusual referrers.
Correlate favicon proxy requests with subsequent authenticated API calls originating from the same browser session within short time windows.
Deploy web application firewall rules that flag or block /misc/favicon requests whose url parameter resolves to SVG content.

Monitoring Recommendations

Alert on any /misc/favicon response with a content type other than image/x-icon, image/png, or image/jpeg.
Monitor authenticated endpoints for unexpected state-changing requests immediately following favicon proxy activity.
Log and review the full Referer and Origin headers on administrative API calls to detect same-origin XSS pivoting.

How to Mitigate CVE-2026-85613

Immediate Actions Required

Upgrade OpenPanel to version 2.3.0 or later, which remediates the favicon proxy handling.
Restrict network access to the OpenPanel administrative interface to trusted management networks until patching is complete.
Invalidate active administrator sessions and rotate API tokens after upgrade to eliminate any hijacked credentials.

Patch Information

OpenPanel version 2.3.0 addresses CVE-2026-85613. Review the GitHub Security Advisory GHSA-r7hx-q6f4-vj6h for the fix commit and release notes before deploying to production.

Workarounds

Block or remove the /misc/favicon route at a reverse proxy such as Nginx or Caddy if immediate patching is not possible.
Enforce a strict Content-Security-Policy response header on OpenPanel that disallows inline script execution on API origins.
Configure upstream filtering to reject responses with the image/svg+xml content type when returned through the favicon proxy.

bash

# Nginx example: block the vulnerable endpoint until patched
location = /misc/favicon {
    return 404;
}