x-ui CVE-2026-79315

Exploitation requires that the victim already be an authenticated x-ui panel user with an active session, and that they click an attacker-crafted URL to the management interface (UI:R) - the attacker themselves needs no credentials (PR:N). The specific trigger is the panel reflecting the raw request URI into a client-side template binding expression used for sidebar menu highlighting; server-side HTML entity escaping does not protect it because the browser decodes entities before the client framework evaluates the string as a JavaScript expression. Limiting factors: the payload only executes within the victim's already-authenticated browser session (no impact on unauthenticated visitors or the server itself), impact is confined to same-origin actions/data theft (no availability impact), and delivery depends on social engineering the operator into visiting the malicious link.

This is a MITRE-assigned reflected XSS in the x-ui management panel (vaxilu/x-ui 0.3.2) rated CVSS 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) - squarely a medium-severity, browser-context issue rather than a server-compromise flaw. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so the exploitation status is 'no public exploit identified at time of analysis'; there is no signal of active or automated exploitation. The vector reflects the real gating factors well: it needs no attacker privileges (PR:N) but does require victim user interaction (UI:R) - specifically an already-authenticated panel operator clicking a crafted URL - and the impact is limited to Low confidentiality and Low integrity within the victim's session (S:C reflects execution jumping into the browser origin). One notable inconsistency: MITRE assigned AC:H, but the description characterizes the flaw as deterministic (server HTML-entity escaping is reliably neutralized because the browser decodes entities before the client-side template engine evaluates the binding), which argues for AC:L; I flag this as a possible overstatement of complexity. Net: a genuine but bounded, targeted-social-engineering-dependent issue, not an internet-scannable mass-exploitation priority.

An attacker crafts a URL to the x-ui panel whose request URI carries a JavaScript payload that lands in the sidebar-highlighting template binding, then lures an already-logged-in panel administrator to click it (e.g., via chat, email, or a forum for proxy operators). When the victim's browser renders the page, the payload executes in the panel's same-origin context, letting the attacker exfiltrate session data or issue authenticated actions as the operator. No public proof-of-concept is identified in the provided intelligence.