{"cve":"CVE-2026-55477","nvd":{"published":"2026-06-25T16:16:40.033","modified":"2026-10-25T22:10:00.150","status":"Deferred","description":"3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","score":7.2},"cwes":["CWE-73"],"references":["https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg","https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg"],"products":[],"source":"nvd","synced_at":"2026-10-25T23:44:33.281319194+00:00"},"epss":{"cve":"CVE-2026-55477","score":0.00615,"percentile":0.49168,"date":"2026-10-25"},"kev":null,"osv":[{"id":"GHSA-jm48-m3rr-9hgg","url":"https://osv.dev/vulnerability/GHSA-jm48-m3rr-9hgg","summary":"3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation","modified":"2026-08-26T01:21:46.139022970Z","packages":[{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui/v3","purl":"pkg:golang/github.com/mhsanaei/3x-ui/v3","ranges":["<3.3.1"],"fixed":["3.3.1"]},{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui/v2","purl":"pkg:golang/github.com/mhsanaei/3x-ui/v2","ranges":["<=2.9.4"],"fixed":[]}]},{"id":"GO-2026-6284","url":"https://osv.dev/vulnerability/GO-2026-6284","summary":"3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui","modified":"2026-08-26T01:21:40.853673279Z","packages":[{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui","purl":"pkg:golang/github.com/mhsanaei/3x-ui","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui/v2","purl":"pkg:golang/github.com/mhsanaei/3x-ui/v2","ranges":["all versions"],"fixed":[]},{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui/v3","purl":"pkg:golang/github.com/mhsanaei/3x-ui/v3","ranges":["<3.3.1"],"fixed":["3.3.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}