CVE-2026-55477 PUBLISHED

Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

Assigner: GitHub_M
Reserved: 16.06.2026 Published: 25.06.2026 Updated: 25.06.2026

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor MHSanaei
Product 3x-ui
Versions
  • Version < 3.3.1 is affected

References

Problem Types

  • CWE-73: External Control of File Name or Path CWE