CVE-2026-79315: XSS
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.
Affected Software
Event History
Frequently Asked Questions
Who can be targeted by this issue?
A logged-in user of the x-ui management panel can be targeted if they are induced to visit a crafted URL. The resulting script runs in the same-origin context of the management page and can act through that user's session.
What does an attacker need to exploit it?
The attacker needs to craft a malicious request URI and cause an authenticated management-panel user to open it. The available information does not indicate that the attacker needs an existing panel account.
Are server-side HTML escaping controls sufficient mitigation?
No. The issue occurs because browser entity decoding happens before the client-side framework evaluates the reflected value as a JavaScript expression, rendering server-side HTML entity escaping ineffective in this template-binding context.