CVE-2025-15632 1Panel-dev CVE debrief

Who should care

Defenders responsible for 1Panel-dev MaxKB deployments should assess exposure and prioritize upgrading to version 2.5.0. This includes reviewing the vulnerability's impact on their specific environments and ensuring that necessary patches or mitigations are applied. Security teams and vulnerability management teams should also be aware of this issue and coordinate with affected operators and platforms to address the vulnerability.

Why it matters

Defenders should care about CVE-2025-15632 because it allows for remote cross-site scripting in 1Panel-dev MaxKB up to 2.4.2, which can lead to attacker-controlled script execution. Affected deployments should prioritize upgrading to version 2.5.0 and monitor for exploitation attempts. The vulnerability's impact and remediation require verification from official sources.

• Remote exploitation of the cross-site scripting vulnerability
• Potential for attacker-controlled script execution
• Need for verification of affected versions and upgrade to 2.5.0
• Importance of monitoring for exploitation attempts

Technical summary

The vulnerability is located in the ui/src/chat.ts file of the MdPreview component in 1Panel-dev MaxKB up to 2.4.2. It allows for cross-site scripting and can be executed remotely. The attack involves manipulating an unknown function in the specified file. Upgrading to version 2.5.0 is recommended to address this issue. The patch 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8 has been provided to fix the vulnerability. However, defenders should verify the affected scope and apply necessary mitigations based on their specific deployments.

Defensive priority

Defenders should prioritize upgrading to version 2.5.0 to address the cross-site scripting vulnerability in 1Panel-dev MaxKB up to 2.4.2.

Recommended defensive actions

• Upgrade to version 2.5.0 to address the cross-site scripting vulnerability
• Review and apply the patch 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8
• Monitor for remote exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and recommended upgrade path. The vulnerability was publicly disclosed on 2026-04-13T10:16:10.160Z. The vendor was contacted early and responded in a very professional manner, quickly releasing a fixed version of the affected product. The patch 7230daa5ec3e6574b6ede83dd48a4fbc0e70b8d8 is noted to address this issue. However, the exact scope of affected deployments and potential impact requires verification from official or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.