# CVE-2026-79315: x-ui reflected cross-site scripting in sidebar menu

Source: https://junglewise.ai/threats/cve-2026-79315-a-reflected-cross-site-scripting-vulnerability-exists-in-x-ui-0-3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-79315 · Severity: medium · CVSS 4.7 · Published 2026-09-22

x-ui is a web-based management panel for proxy services that allows administrators to configure and monitor Xray proxy instances. The management interface unsafely reflects request URIs into client-side template expressions in the sidebar menu. A logged-in administrator visiting a crafted link could have arbitrary JavaScript executed in their browser session, allowing attackers to steal session data, modify proxy configurations, or abuse the administrator's permissions without their knowledge.

Technologies: [Vaxilu X-Ui](https://junglewise.ai/threats/technologies/x-ui). Vendors: [Vaxilu](https://junglewise.ai/threats/vendors/vaxilu).

## Quick answers

**Is CVE-2026-79315 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-79315 being exploited in the wild.

**How severe is CVE-2026-79315?** Medium severity, with a CVSS score of 4.7, published 22 September 2026.

**Which products and versions are affected?** Vaxilu X-Ui 0.3.2.

**Is there a fix for CVE-2026-79315?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-79315 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-79315?** Check whether you run Vaxilu X-Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a reflected XSS (CWE-79) caused by improper output encoding: the server applies only HTML entity escaping to the request URI before inserting it into a client-side framework binding expression. The browser decodes entities before the framework evaluates the content as JavaScript, allowing unescaped script execution. Exploitation requires a logged-in user to visit an attacker-controlled URL, enabling data theft and unauthorized actions within the panel's same-origin context.

## Affected products

- vaxilu x-ui 0.3.2

## Timeline

- 2026-09-22: disclosed: Public disclosure via NVD
- 2026-08-04: other: Advisory report date

## References

- [https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79315.md](https://github.com/lichoin/TraceLoom/blob/main/CVEs/CVE-2026-79315.md)
- [https://github.com/vaxilu/x-ui](https://github.com/vaxilu/x-ui)

## Related threats

- [x-ui horizontal privilege escalation in inbound configuration management](https://junglewise.ai/threats/cve-2026-79314-a-horizontal-privilege-escalation-vulnerability-exists-in-x-ui-0)
- [x-ui session invalidation flaw in credential change](https://junglewise.ai/threats/cve-2026-79317-a-session-invalidation-flaw-exists-in-x-ui-0-3-2-the-full-user)
- [x-ui improper access control in Xray configuration template](https://junglewise.ai/threats/cve-2026-79316-an-improper-access-control-vulnerability-exists-in-x-ui-0-3-2-any)