3x-ui vulnerabilities

2 known vulnerabilities in 3x-ui from MHSanaei. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  3x-ui: External Control of File Name or Path

  CVE-2026-55477Jun 25, 2026MHSanaei

  3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. T

• 9.8 Critical severity

  3x-ui: Improper Certificate Validation

  CVE-2025-29331Jun 26, 2025MHSanaei

  An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check certificate option to wget when downloading updates