CVE-2026-55477

Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation

State: Published
Severity: 7.2 High
Published: Jun 25, 2026
Updated: Jun 25, 2026
Reserved: Jun 16, 2026

Description

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path

Affected Products

Product	Versions
3x-uiMHSanaei	< 3.3.1Affected

References

https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.