What is the CVSS score of CVE-2026-33061?

CVE-2026-33061 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33061?

Organizations using exactyl should be aware of moderate risk from CVE-2026-33061, a cross-site scripting vulnerability rated CVSS 5.8.

How to fix or mitigate CVE-2026-33061?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Verify Content-Security-Policy and output encoding.

PHP CVE-2026-33061

EUVD-2026-13622 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-03-20 security-advisories@github.com

XSS PHP

5.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.8 MEDIUM

AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13622

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 08:16 nvd

MEDIUM 5.8

DescriptionGitHub Advisory

exactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.

AnalysisAI

Jexactyl, a game management panel and billing system, contains a stored DOM-based cross-site scripting (XSS) vulnerability in its template rendering engine where server-side objects are injected into client-side JavaScript without proper escaping. The vulnerability affects versions after commit 025e8dbb0daaa04054276bda814d922cf4af58da and before the patched commit e28edb204e80efab628d1241198ea4f079779cfd, allowing authenticated attackers with high privileges to inject malicious payloads through attacker-controlled fields such as usernames or display names that execute arbitrary JavaScript in the browsers of all users viewing the affected page. The CVSS score of 5.8 reflects local attack vector requirements and high privilege prerequisites, though the stored nature of the XSS and lack of user interaction requirements for viewing the malicious content represent meaningful security risk for multi-user deployments.

Technical ContextAI

The vulnerability exists in the Blade templating engine used by Jexactyl (a Laravel-based application), specifically in the resources/views/templates/wrapper.blade.php template file. The root cause is the use of unescaped Blade syntax {!! json_encode(...) !!} without adequate encoding flags to safely convert server-side PHP objects to JavaScript literals. According to CWE-79 (Improper Neutralization of Input During Web Page Generation), the application fails to sanitize or properly escape user-controlled data before embedding it into JavaScript context. The json_encode() function alone is insufficient because while it escapes JSON special characters, it does not escape characters that have special meaning in JavaScript or HTML contexts (such as forward slashes or closing script tags). When serialized fields containing attacker-controlled content are rendered through this vulnerable code path, the browser interprets them as executable JavaScript rather than string data, enabling script injection.

RemediationAI

Upgrade Jexactyl to a version that includes commit e28edb204e80efab628d1241198ea4f079779cfd or later. Users can verify their patch status by checking the commit history in their local repository against the reference at https://github.com/Jexactyl/Jexactyl/commit/e28edb204e80efab628d1241198ea4f079779cfd. For immediate interim protection on unpatched instances, restrict access to the Jexactyl panel to trusted networks using firewall rules or a reverse proxy with IP allowlisting, and audit user permissions to limit the number of accounts with profile-edit capabilities. Additionally, implement Content Security Policy (CSP) headers with script-src restrictions to mitigate the impact of any injected scripts. Review and sanitize any existing user-controlled data in the database (usernames, display names, site config) for suspicious JavaScript patterns as a precautionary measure. For detailed patching instructions and security advisories, consult https://github.com/Jexactyl/Jexactyl/security/advisories/GHSA-6xgw-mmmv-57h2.