Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
Priority HIGH 67CWE-73Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00615 49th percentileScored 2026-11-07
Fix Fixed 3x-ui (MHSanaei): 3.3.1github.com/mhsanaei/3x-ui/v3 (Go): 3.3.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| MHSanaei | 3x-ui | before 3.3.1 | 3.3.1 | Patch available | CNA |
| — | github.com/mhsanaei/3x-ui/v3 (Go) | before 3.3.1 | 3.3.1 | Patch available | GHSA-jm48-m3rr-9hgg |
| — | github.com/mhsanaei/3x-ui/v2 (Go) | up to 2.9.4 | — | No fix listed | GHSA-jm48-m3rr-9hgg |
- 3x-ui VendorMHSanaei Affected before 3.3.1 Fixed in 3.3.1 Patch available CNA
- github.com/mhsanaei/3x-ui/v3 (Go) Vendor— Affected before 3.3.1 Fixed in 3.3.1 Patch available GHSA-jm48-m3rr-9hgg
- github.com/mhsanaei/3x-ui/v2 (Go) Vendor— Affected up to 2.9.4 Fixed in — No fix listed GHSA-jm48-m3rr-9hgg
Remediation
- Fix · CNA 3x-ui (MHSanaei) Fixed in 3.3.1
- Fix · GHSA-jm48-m3rr-9hgg github.com/mhsanaei/3x-ui/v3 (Go) Fixed in 3.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-55477
- 2026-10-03 Alias added: GHSA-jm48-m3rr-9hgg
References
More MHSanaei vulnerabilities
- TI-2025-21044 An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-55477 · CVE Program
- CVE-2026-55477 · NVD
- FIRST EPSS
- GHSA-jm48-m3rr-9hgg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences