CVE-2026-55477GO-2026-6284GHSA-JM48-M3RR-9HGG
Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.3.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
CISA's decision points: whether it is exploited, whether attacks can be automated, and how much control an attacker gets. Assessed (SSVC 2.0.3).What do these mean? →
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- MHSanaei 3x-ui
fixed in 3.3.1
- github.com/mhsanaei/3x-uiGo
All versions
- github.com/mhsanaei/3x-ui/v2Go
All versions
- github.com/mhsanaei/3x-ui/v3Go
fixed in 3.3.1
- github.com/mhsanaei/3x-ui/v2Go
through 2.9.4