{"vulnerability": "CVE-2026-55477", "sightings": [{"uuid": "9e7e4120-3832-4d13-a6af-0556c18a13b6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-55477", "type": "published-proof-of-concept", "source": "https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg", "content": "", "creation_timestamp": "2026-08-24T22:35:03.708003Z"}, {"uuid": "de131661-69d7-4980-a234-5154f6313008", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-55477", "type": "seen", "source": "https://gist.github.com/alon710/782a9d0e0a33092c615e2219299ab6e3", "content": "# CVE-2026-55477: CVE-2026-55477: Authenticated Arbitrary File Write in MHSanaei 3X-UI via Database Import\n\n> **CVSS Score:** 7.2\n> **Published:** 2026-08-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-55477\n\n## Summary\nMHSanaei 3X-UI is a web control panel for managing Xray-core servers. In versions prior to 3.3.1, an authenticated administrator can abuse database import functions or raw template config fields to overwrite or append to arbitrary files on the host filesystem. This is achieved by altering the Xray log configuration variables to target system files, leveraging logging components to inject payloads.\n\n## TL;DR\nAn authenticated administrator in 3X-UI versions prior to 3.3.1 can perform remote code execution with root privileges by manipulating Xray log file paths to target host files like authorized_keys.\n\n## Technical Details\n\n- **CWE ID**: CWE-73 (External Control of File Name or Path)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.2\n- **EPSS Score**: 0.00615 (Percentile: 46.77%)\n- **Exploit Status**: PoC / Conceptual\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- 3X-UI Control Panel\n\n## Mitigation\n\n- Upgrade 3X-UI to version 3.3.1 or newer to enforce strict folder confinement of log files.\n- Restrict administration port access to trusted source IP addresses via firewall filters.\n- Execute the Xray daemon process under a restricted, non-root system account.\n\n**Remediation Steps:**\n1. Download the v3.3.1 patch from the repository releases.\n2. Review the DB settings table to ensure log parameters do not point to absolute target paths.\n3. Deploy the updated application container or execution scripts.\n\n## References\n\n- [GitHub Security Advisory (GHSA-jm48-m3rr-9hgg)](https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg)\n- [NVD Vulnerability Details](https://nvd.nist.gov/vuln/detail/CVE-2026-55477)\n- [Official Fix Commit](https://github.com/MHSanaei/3x-ui/commit/80e168787ed608e83a065033ee94c8bfc3025ce7)\n- [Secure Release (v3.3.1)](https://github.com/MHSanaei/3x-ui/releases/tag/v3.3.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-55477) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-08-25T12:31:18.455201Z"}]}