CVE-2026-55477: 3X-UI Admin Database Import Arbitrary File Write (CVSS 7.2)

Technical summary

The vulnerability exists in 3X-UI's database import functionality, which fails to properly validate or sanitize Xray configuration values before writing them to the filesystem. An authenticated administrator can craft a malicious database import that modifies configuration parameters to specify arbitrary file paths and content. Because Xray configuration is typically trusted and may be parsed with elevated privileges, this enables arbitrary file write. The attack surface is limited to authenticated users with administrative privileges, but the impact is severe: an attacker can write files into critical directories, potentially including executable locations or configuration directories that Xray loads at startup, resulting in code execution within the Xray process context.

Business impact

If an administrator account is compromised or if a malicious insider gains administrative access to 3X-UI, they can achieve persistent code execution on the underlying Xray servers. This can lead to traffic interception, malicious routing configuration, unauthorized access to encrypted communications, or lateral movement into the network. Organizations relying on Xray-core for proxy/VPN functionality face loss of confidentiality and integrity of traffic flowing through the infrastructure. Recovery requires identifying compromised configuration files and potentially reimaging affected systems.

Affected systems

3X-UI versions prior to 3.3.1 are affected. The vulnerability requires an authenticated administrator account, so exposure is limited to environments where admin credentials are at risk or where untrusted users have been granted admin roles. The impact scales with the privileges of the Xray process; if Xray runs as root, code execution is root-level.

Exploitability

Exploitation requires valid administrative credentials for the 3X-UI panel. No network-layer exploit or unauthenticated bypass is known. However, the attack itself is straightforward once authenticated: an attacker simply imports a specially crafted database with malicious configuration values. The barrier to exploitation is thus credential compromise rather than technical complexity. The ability to achieve code execution makes this high-priority despite the authentication requirement.

Remediation

Upgrade 3X-UI to version 3.3.1 or later. Organizations should also audit administrative access logs to detect any suspicious import activities or file modifications that may have occurred before patching. Review file integrity monitoring logs for unexpected changes in Xray configuration or binary directories. If administrative credentials may have been compromised, reset them and review recent activity.

Patch guidance

Verify your installed version of 3X-UI and upgrade to 3.3.1 or later according to the project's release instructions. Ensure Xray-core is restarted cleanly after the upgrade to clear any in-memory state. Test the import functionality in a staging environment if possible to confirm patch behavior before production deployment. Document the upgrade timestamp for audit records.

Detection guidance

Monitor for suspicious database import operations, particularly imports that modify Xray configuration paths or file permissions. Watch for unexpected file creation or modification in directories where Xray stores configuration or binaries. Enable audit logging on the 3X-UI panel if available and correlate import events with filesystem changes. Check Xray process logs for errors or unexpected configuration loads that might indicate a compromise. File integrity monitoring tools can alert on unauthorized changes to Xray config or executable directories.

Why prioritize this

This vulnerability scores 7.2 (HIGH) due to the combination of high confidentiality, integrity, and availability impact with low attack complexity. Although authentication is required, the severity of the impact—remote code execution as the Xray user, potentially root—and the likelihood that admin credentials could be compromised via phishing, credential reuse, or insider threat elevate this to urgent priority. Organizations should prioritize patching within their standard high-severity window.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects: (1) Network accessibility (AV:N), reducing the barrier to exploitation; (2) low attack complexity (AC:L), as the exploit requires only standard database import functionality; (3) high privilege requirement (PR:H), which limits the initial threat actors but does not eliminate it; (4) no user interaction (UI:N); (5) unchanged scope (S:U); and (6) complete impact across confidentiality, integrity, and availability (C:H/I:H/A:H), since code execution can be weaponized for any objective. The score appropriately reflects a high-risk vulnerability that should be treated as critical in environments where admin credential compromise is plausible.

Frequently asked questions