Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-33061— Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template

Quick assessment

Affected
Jexactyl Jexactyl
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Jexpanel是Jexactyl开源的一个游戏服务器管理与计费面板。 Jexpanel存在安全漏洞，该漏洞源于wrapper.blade.php模板使用未转义的json_encode，可能导致存储型DOM跨站脚本攻击。

CVSS 5.8 · Medium EPSS 0.24% · P14
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-33061

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Jexactyl has Stored DOM Cross-Site Scripting (XSS) via unescaped JSON in Blade template
Source: CVE Program / CVE List V5
Vulnerability Description
Jexactyl is a customisable game management panel and billing system. Commits after 025e8dbb0daaa04054276bda814d922cf4af58da and before e28edb204e80efab628d1241198ea4f079779cfd inject server-side objects into client-side JavaScript through resources/views/templates/wrapper.blade.php. Using unescaped {!! json_encode(...) !!} without safe encoding flags allows string values to break out of the JavaScript context and be interpreted as HTML/JS by the browser. If any serialized fields contain attacker-controlled content, such as a username, display name, or site config value, a malicious payload will execute arbitrary script for any user viewing the page (stored DOM XSS). This issue has been patched by commit e28edb204e80efab628d1241198ea4f079779cfd.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
Jexpanel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Jexpanel是Jexactyl开源的一个游戏服务器管理与计费面板。 Jexpanel存在安全漏洞，该漏洞源于wrapper.blade.php模板使用未转义的json_encode，可能导致存储型DOM跨站脚本攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Jexactyl Jexactyl >= 025e8dbb0daaa04054276bda814d922cf4af58da, < e28edb204e80efab628d1241198ea4f079779cfd -

II. Public POCs for CVE-2026-33061

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-33061

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-33061 (1)

Vendor Advisories for CVE-2026-33061 (1)

IV. Related Vulnerabilities

Same product: Jexactyl
Same vendor: Jexactyl
Same weakness: CWE-79

V. Comments for CVE-2026-33061

No comments yet

Leave a comment