Description

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-09-22T15:17:15.777Z",
  "pubdate": "2026-09-22T15:17:15.777Z",
  "executiveSummary": "A reflected cross-site scripting (XSS) vulnerability exists in the management interface of x-ui version 0.3.2. The vulnerability stems from improper handling of the request URI, which is reflected directly into a client-side template binding expression.\nThis flaw allows an attacker to execute arbitrary JavaScript within the security context of the victim's session. Successful exploitation enables unauthorized actions, session hijacking, and potential data exfiltration from the management panel.\nThe vulnerability requires the target user to be authenticated and to visit a maliciously crafted URL. Because the application processes user-supplied input through a client-side framework, standard server-side HTML entity encoding is rendered ineffective, as the browser decodes these entities before the JavaScript execution occurs.\nThe risk is significant for administrative interfaces where session cookies or sensitive configuration data are accessible. Attackers can leverage this to gain unauthorized control over the x-ui instance, leading to a complete compromise of the underlying infrastructure managed by the panel.",
  "technicalDetails": "The root cause of this vulnerability is a design flaw in how the x-ui management interface processes the request URI for UI state management. Specifically, the application reflects the raw request URI into a client-side template binding expression intended for sidebar menu highlighting.\nIn version 0.3.2, the application's front-end framework evaluates the bound data as executable JavaScript. While the server attempts to apply HTML entity escaping, this defense mechanism is insufficient because the browser decodes these entities during the rendering phase before the client-side framework parses the template. Consequently, an attacker can bypass traditional server-side filters by encoding their payload using entities that the browser will subsequently interpret as active code.\nThe attack flow begins when an attacker constructs a URL containing a malicious JavaScript payload embedded within the URI parameters or path. When an authenticated user clicks this link, the x-ui application receives the request and reflects the payload into the Document Object Model (DOM) of the management page. Upon page load, the client-side templating engine processes the input, treats the payload as an expression, and executes the contained JavaScript.\nExploitation requires the victim to have an active, authenticated session with the x-ui panel. Because the script executes within the same-origin context of the management interface, the attacker gains full access to the victim's session cookies, local storage, and the ability to perform any action the victim is authorized to execute. This includes, but is not limited to, modifying system configurations, changing user credentials, or triggering further administrative actions.\nThe vulnerability is primarily triggered through the reflection of the URI during the highlighting logic of the sidebar. Since this logic is executed client-side, the input remains 'live' throughout the rendering process. There is no requirement for high-privilege access to trigger the flaw; however, the impact is magnified when the victim possesses administrative or elevated privileges within the panel. The lack of robust Content Security Policy (CSP) headers or input sanitization on the client-side allows this reflected XSS to persist throughout the session rendering cycle, providing a reliable vector for remote code execution in the context of the user's browser."
}