Vulnerability · Published Jun 25, 2026 · Assigned by GitHub_M
CVE-2026-55477Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
High 7.2
In plain English
A high-severity security flaw in 3x-ui from MHSanaei. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/mhsanaei/3x-ui | no fix listed | GO-2026-6284 |
| Go | github.com/mhsanaei/3x-ui/v2 | no fix listed | GHSA-jm48-m3rr-9hgg |
| Go | github.com/mhsanaei/3x-ui/v2 | no fix listed | GO-2026-6284 |
| Go | github.com/mhsanaei/3x-ui/v3 | 3.3.1 | GHSA-jm48-m3rr-9hgg |
| Go | github.com/mhsanaei/3x-ui/v3 | 3.3.1 | GO-2026-6284 |
Affected products (as reported)
Weakness: CWE-73 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg x_refsource_CONFIRM