CVE-2026-55477 Details

A vulnerability in 3X-UI, a web control panel for managing Xray-core servers, allows authenticated administrators to perform arbitrary file writes on the host. This issue exists in versions prior to 3.3.1. The vulnerability arises from the database import functionality, which inadequately validates configuration values. By exploiting this flaw, an administrator can modify Xray log path settings to point to a writable file, such as the SSH authorized keys file. Once the database is imported, the injected content is written to the specified file, potentially leading to code execution and persistent access as the user running Xray, including root access if Xray is executed as root.

Users are advised to upgrade to version 3.3.1, where this vulnerability has been fixed. The update restricts the Xray log path values to the panel's log folder, preventing unauthorized file writes outside of designated areas. Until the update can be applied, it is recommended to limit panel administrator access to trusted individuals.