CVE-2026-79315
Received Received - Intake

Reflected XSS in x-ui Management Interface

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: MITRE

Description
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-79315
EUVD
EUVD-2026-84465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vaxilu x-ui to 0.3.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-79315 is a reflected cross-site scripting (XSS) vulnerability in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression for sidebar menu highlighting. Server-side HTML entity escaping fails because the browser decodes entities before the client-side framework evaluates the content as JavaScript. This allows arbitrary script execution in the same-origin context of the management page when a logged-in user visits a crafted URL.

Detection Guidance

To detect this reflected XSS vulnerability in x-ui 0.3.2, monitor network traffic for suspicious URI patterns containing script tags or event handlers. Check server logs for repeated requests with encoded payloads like %3Cscript%3E or %22onerror%3D. Use browser developer tools to inspect responses for raw URI reflection in the sidebar menu component.

Impact Analysis

An attacker can trick a logged-in user into clicking a malicious link, enabling script execution in the user's session. This allows data theft, unauthorized actions through the victim's session, interaction with management interfaces, modification of settings, and exfiltration of sensitive data from the x-ui panel.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Exploitation may result in data breaches, unauthorized modifications, and loss of control over protected health or personal information, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Immediately upgrade x-ui to the latest patched version once available. As a temporary measure, implement a reverse proxy to normalize or block unusual query strings. Apply strict Content Security Policy headers to restrict inline script execution. Shorten session lifetimes and avoid clicking untrusted links while logged into the management interface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79315. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart