CVE-2026-55477
Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.
| CWE | CWE-73 |
| Vendor | mhsanaei |
| Product | 3x-ui |
| Published | Jun 25, 2026 |
| Last Updated | Jun 25, 2026 |
Stay Ahead of the Next One
Get instant alerts for mhsanaei 3x-ui
Be the first to know when new high vulnerabilities affecting mhsanaei 3x-ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
MHSanaei / 3x-ui
< 3.3.1