CVE-2026-55477 Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation
Authenticated administrators can achieve arbitrary file write and code execution by manipulating Xray log paths via database import.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55477?
CVE-2026-55477 is a high-severity path traversal vulnerability in MHSanaei 3x-ui, published on 25 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.
Weakness: CWE-73
Which versions are affected by CVE-2026-55477?
7 open source packages ship an affected version, including github.com/mhsanaei/3x-ui/v2, github.com/mhsanaei/3x-ui and github.com/mhsanaei/3x-ui/v3.
| Package | Affected | Fixed in |
|---|---|---|
github.com/mhsanaei/3x-ui/v2 Go | All versions | None |
github.com/mhsanaei/3x-ui/v2 Go | All versions to 2.9.4 | None |
github.com/mhsanaei/3x-ui/v2 Go | All versions to 2.9.4 | None |
github.com/mhsanaei/3x-ui Go | All versions | None |
github.com/mhsanaei/3x-ui/v3 Go | All versions | 3.3.1 |
github.com/mhsanaei/3x-ui/v3 Go | All versions | 3.3.1 |
1 more packages
github.com/mhsanaei/3x-ui/v3 Go | All versions | 3.3.1 |
How do I fix CVE-2026-55477?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-55477 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55477 exists.
Sources
Also known as GHSA-jm48-m3rr-9hgg, GO-2026-6284.