What is the CVSS score of CVE-2026-55477?

CVE-2026-55477 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of 3X-UI are affected by CVE-2026-55477?

3X-UI versions prior to 3.3.1 allow authenticated administrators to write arbitrary files with Xray process privileges-typically root in self-hosted environments-enabling complete system compromise.. A patch is available.

Is there a public PoC exploit available for CVE-2026-55477?

Yes, a public proof-of-concept exploit is available for CVE-2026-55477. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate CVE-2026-55477?

Within 24 hours: inventory all 3X-UI deployments and identify versions currently in use. Within 7 days: apply patch by upgrading all instances to version 3.3.1 or later, prioritizing systems running with elevated privileges. Within 30 days: audit logs and file system modifications during the exposure window to detect unauthorized file writes.

3X-UI CVE-2026-55477

EUVD-2026-39432 HIGH

External Control of File Name or Path (CWE-73)

2026-06-25 GitHub_M

GHSA-jm48-m3rr-9hgg

RCE 3x Ui Suse

7.2

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable panel feature (AV:N/AC:L) but requires an authenticated admin (PR:H); arbitrary file write yields code execution with full C/I/A impact and no scope change.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 25, 2026 - 17:02 EUVD

Analysis Generated

Jun 25, 2026 - 16:21 vuln.today

DescriptionCVE.org

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

AnalysisAI

Arbitrary file write in 3X-UI, a web control panel for managing Xray-core proxy servers, allows an authenticated administrator to write attacker-controlled files anywhere on the host by tampering with Xray configuration values through the database import feature in versions prior to 3.3.1. Because the written files execute in the context of the Xray process - frequently root in self-hosted deployments - this escalates to full code execution and persistent host compromise. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is resolved in release 3.3.1.

Technical ContextAI

3X-UI is a Go-based web administration panel that wraps Xray-core, storing proxy and inbound/outbound configuration in a backing database. The vulnerability is classed as CWE-73 (External Control of File Name or Path): configuration values that the application later materializes to disk are not constrained to a safe directory, so an operator who supplies a crafted database export and re-imports it can steer a write to an arbitrary host path. The CPE cpe:2.3:a:mhsanaei:3x-ui:*:*:*:*:*:*:*:* confirms the affected component is the MHSanaei 3x-ui project across all versions below the fixed build. Because Xray frequently runs as a privileged service to bind low ports and manage networking, the file write inherits that privilege level.

RemediationAI

Upgrade to 3X-UI 3.3.1, which contains the fix, per the vendor advisory at https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg (vendor-released patch: 3.3.1). Until the upgrade is applied, reduce exposure by ensuring the panel is not reachable from the public internet - bind it to localhost and reach it over an SSH tunnel or VPN, and place it behind an IP allowlist or reverse-proxy authentication - which limits who can authenticate and reach the database import feature at the cost of less convenient remote administration. Rotate the administrator credentials and enforce strong, unique passwords plus two-factor where available to shrink the credential-theft path that bridges the PR:H requirement. As a defense-in-depth control with an availability trade-off, run Xray under a dedicated unprivileged service account rather than root so that an arbitrary write does not immediately yield root-level persistence; note this may require granting CAP_NET_BIND_SERVICE or using higher ports. Avoid importing untrusted database exports.