CVE-2026-55477

Published: Jun 25, 2026Modified: Jun 25, 2026Deferred

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: security-advisories@github.com (Secondary)

Description

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (2)

https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg

Source: security-advisories@github.com

https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.