CVE-2026-79315
MediumCVSS 4.7Summary
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.
Risk Assessment
An attacker can steal session data or perform unauthorized actions in the context of a logged-in panel user, potentially leading to admin account takeover and compromise of the entire system.
Recommendation
Update x-ui to a patched version. Additionally, educate users about the risk of clicking suspicious links and consider additional protections such as anti-XSS filters.
Other vulnerabilities in x-ui
See all- CVE-2026-79314Unknown
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data.
- CVE-2026-79317Medium
Session invalidation flaw in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication does not re-validate against the database. Changing username or password does not revoke previously issued cookies, so an attacker with a valid cookie can continue accessing the admin panel.
- CVE-2026-79316High
Improper access control vulnerability in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template and trigger a panel restart, causing the xray management gRPC service, bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary.
Original NVD description (English source)
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.