ByteOS Network

NVD Vulnerability Details :

CVE-2026-55477

Received

Source-security-advisories@github.com

Published At-25 Jun, 2026 | 16:16

Updated At-25 Jun, 2026 | 17:16

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	7.2	HIGH	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
			N/A

Type: Secondary

Version: 3.1

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

Weaknesses

CWE ID	Type	Source
CWE-73	Secondary	security-advisories@github.com

CWE ID: CWE-73

Type: Secondary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg	security-advisories@github.com	N/A
https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg	134c704f-9b21-4f2e-91b3-4a467353bcc0	N/A

Hyperlink: https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg

Source: security-advisories@github.com

Resource: N/A

Hyperlink: https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Resource: N/A

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History