CVE-2026-55477: CVE-2026-55477: Authenticated Arbitrary File Write in MHSanaei 3X-UI via Database Import

#security #cve #cybersecurity

CVE-2026-55477: Authenticated Arbitrary File Write in MHSanaei 3X-UI via Database Import

Vulnerability ID: CVE-2026-55477
CVSS Score: 7.2
Published: 2026-08-24

MHSanaei 3X-UI is a web control panel for managing Xray-core servers. In versions prior to 3.3.1, an authenticated administrator can abuse database import functions or raw template config fields to overwrite or append to arbitrary files on the host filesystem. This is achieved by altering the Xray log configuration variables to target system files, leveraging logging components to inject payloads.

TL;DR

An authenticated administrator in 3X-UI versions prior to 3.3.1 can perform remote code execution with root privileges by manipulating Xray log file paths to target host files like authorized_keys.

Technical Details

CWE ID: CWE-73 (External Control of File Name or Path)
Attack Vector: Network
CVSS v3.1 Score: 7.2
EPSS Score: 0.00615 (Percentile: 46.77%)
Exploit Status: PoC / Conceptual
CISA KEV Status: Not Listed

Affected Systems

3X-UI Control Panel

Mitigation Strategies

Upgrade 3X-UI to version 3.3.1 or newer to enforce strict folder confinement of log files.
Restrict administration port access to trusted source IP addresses via firewall filters.
Execute the Xray daemon process under a restricted, non-root system account.

Remediation Steps:

Download the v3.3.1 patch from the repository releases.
Review the DB settings table to ensure log parameters do not point to absolute target paths.
Deploy the updated application container or execution scripts.

References

Read the full report for CVE-2026-55477 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community