3X-UI CVE-2026-55477

Exploitation requires an authenticated 3X-UI administrator session (CVSS PR:H) and access to the panel's database import functionality; the attacker abuses Xray configuration values stored in the database to direct an arbitrary file write on the host. The concrete prerequisite is the ability to supply and import a crafted database/configuration into 3X-UI versions before 3.3.1. The severity of the outcome scales with how Xray is run: full root compromise only occurs when Xray runs as root, whereas a less-privileged service account limits the write to that account's permissions. Limiting factors: no exploitation is possible without valid admin credentials and reachability to the panel, so panels restricted to localhost/VPN or protected by strong authentication and 2FA are not exploitable by external unauthenticated actors.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - network-reachable and low-complexity, but gated by PR:H, i.e. it requires an already-authenticated administrator. This is the dominant mitigating factor: the attacker must already control the panel, so the realistic threat model is a malicious/compromised admin, credential theft, or an exposed panel with weak/default credentials, rather than opportunistic mass exploitation. No EPSS score, KEV entry, or POC was provided in the input, so there is no signal of active or automated exploitation; SSVC inputs (exploitation status, automatable, technical impact) were not supplied. The technical impact is severe (root-level code execution and persistence), but the privilege prerequisite keeps this in the 'high but not emergency' tier for most deployments - prioritize for any internet-exposed 3X-UI instance, where credential compromise plausibly bridges the PR:H gap.

An attacker who has obtained 3X-UI administrator access - for example by phishing or reusing leaked credentials against an internet-exposed panel - crafts a malicious database export that embeds Xray configuration values pointing a file write to a sensitive host path such as a cron directory, an SSH authorized_keys file, or a service startup script. Using the panel's database import functionality, they trigger the write and obtain code execution as the Xray user (root where Xray runs as root), establishing persistent access. No public proof-of-concept was identified in the provided data, and the network-reachable, low-complexity vector means the only real barrier is obtaining the administrator session.