CVE-2026-55477: Panel authenticated file write leads

Q: Is CVE-2026-55477 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55477, increasing the risk of exploitation.

Q: How to fix CVE-2026-55477?

Upgrade 3X-UI to 3.3.1 or later immediately — this is the only complete fix. Until patched, restrict panel access to a trusted management network or VPN and enforce strong, unique admin credentials with MFA where supported to reduce the chance of an attacker obtaining the privileged access this bug requires. Audit database import/export logs and Xray configuration change history for unexpected values or unfamiliar file paths. After patching, review the host for persistence artifacts (unexpected cron entries, modified systemd units, unauthorized SSH keys) in case the flaw was already exploited, and rotate any credentials or secrets that were accessible to the Xray process.

Q: What systems are affected by CVE-2026-55477?

This vulnerability affects the following AI/ML architecture patterns: Not an AI/ML architecture — 3X-UI is a general-purpose proxy/VPN control panel with no genuine connection to model serving, training, RAG, or agent frameworks, Relevant only indirectly: network/proxy infrastructure fronting AI inference or agent services could have its host compromised.

Q: What is the CVSS score for CVE-2026-55477?

CVE-2026-55477 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.61%.

CISO Take

3X-UI, a widely used web control panel for managing Xray-core proxy servers, lets an authenticated administrator abuse the database import feature to write arbitrary files to the host, ultimately achieving code execution as the user running Xray — root in many deployments. Despite the 'ml_ui' tag applied by our pipeline, this is not genuinely an AI/ML vulnerability: 3X-UI has no relationship to machine learning frameworks, model serving, or LLM tooling, and it does not appear in our tracked AI package catalog, so this alert exists mainly for infrastructure completeness. Exploitation requires high privileges (PR:H, CVSS 7.2) and EPSS sits at only the 53rd percentile with no CISA KEV listing, but a public PoC exists and the package has 502 downstream dependents, so any organization running 3X-UI — including as a proxy layer in front of AI inference endpoints — should still treat this as urgent. Patch to 3.3.1 immediately, rotate credentials on affected instances, and audit configuration-import activity for anomalies. Given the absence of a real AI angle, this does not warrant a breaking alert to AI-security teams — it's a standard infrastructure patch, not an AI attack vector.

Sources: NVD GitHub Advisory EPSS

What is the risk?

Network-exploitable with low attack complexity and no user interaction, but gated behind a requirement for high privileges (an authenticated administrator account), which meaningfully limits the attacker population to insiders, compromised admin credentials, or chained access from a separate initial-access vulnerability. Impact if achieved is severe — full confidentiality, integrity, and availability compromise via arbitrary code execution, potentially as root. A public PoC lowers the bar for anyone who does obtain admin access. EPSS (0.6%, 53rd percentile) and absence from CISA KEV suggest no observed mass exploitation yet, consistent with the privilege prerequisite reducing opportunistic attack volume.

How does the attack unfold?

Initial Access

Attacker obtains valid 3X-UI administrator credentials through credential stuffing, phishing, insider access, or a chained vulnerability.

Exploitation

Using the database import feature, the attacker modifies stored Xray configuration values to include a malicious file path and content.

Arbitrary File Write

3X-UI regenerates the Xray configuration from the tampered database values, writing an attacker-controlled file to an arbitrary location on the host.

Impact

The written file executes with the privileges of the Xray process, often root, giving the attacker persistent code execution and full host compromise.

Initial Access

Attacker obtains valid 3X-UI administrator credentials through credential stuffing, phishing, insider access, or a chained vulnerability.

Exploitation

Using the database import feature, the attacker modifies stored Xray configuration values to include a malicious file path and content.

Arbitrary File Write

3X-UI regenerates the Xray configuration from the tampered database values, writing an attacker-controlled file to an arbitrary location on the host.

Impact

The written file executes with the privileges of the Xray process, often root, giving the attacker persistent code execution and full host compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	go	<= 2.9.4	No patch
5.8K OpenSSF 6.7 505 dependents Pushed 2d ago 69% patched ~15d to patch Full package profile →
Panel	go	<= 3.3.0	`3.3.1`
5.8K OpenSSF 6.7 505 dependents Pushed 2d ago 69% patched ~15d to patch Full package profile →

How severe is it?

CVSS 3.1

7.2 / 10

EPSS

0.6%

chance of exploitation in 30 days

Higher than 48% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR High

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade 3X-UI to 3.3.1 or later immediately — this is the only complete fix. Until patched, restrict panel access to a trusted management network or VPN and enforce strong, unique admin credentials with MFA where supported to reduce the chance of an attacker obtaining the privileged access this bug requires. Audit database import/export logs and Xray configuration change history for unexpected values or unfamiliar file paths. After patching, review the host for persistence artifacts (unexpected cron entries, modified systemd units, unauthorized SSH keys) in case the flaw was already exploited, and rotate any credentials or secrets that were accessible to the Xray process.

How is it classified?

Code Execution API

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-55477?

3X-UI, a widely used web control panel for managing Xray-core proxy servers, lets an authenticated administrator abuse the database import feature to write arbitrary files to the host, ultimately achieving code execution as the user running Xray — root in many deployments. Despite the 'ml_ui' tag applied by our pipeline, this is not genuinely an AI/ML vulnerability: 3X-UI has no relationship to machine learning frameworks, model serving, or LLM tooling, and it does not appear in our tracked AI package catalog, so this alert exists mainly for infrastructure completeness. Exploitation requires high privileges (PR:H, CVSS 7.2) and EPSS sits at only the 53rd percentile with no CISA KEV listing, but a public PoC exists and the package has 502 downstream dependents, so any organization running 3X-UI — including as a proxy layer in front of AI inference endpoints — should still treat this as urgent. Patch to 3.3.1 immediately, rotate credentials on affected instances, and audit configuration-import activity for anomalies. Given the absence of a real AI angle, this does not warrant a breaking alert to AI-security teams — it's a standard infrastructure patch, not an AI attack vector.

Is CVE-2026-55477 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-55477, increasing the risk of exploitation.

How to fix CVE-2026-55477?

Upgrade 3X-UI to 3.3.1 or later immediately — this is the only complete fix. Until patched, restrict panel access to a trusted management network or VPN and enforce strong, unique admin credentials with MFA where supported to reduce the chance of an attacker obtaining the privileged access this bug requires. Audit database import/export logs and Xray configuration change history for unexpected values or unfamiliar file paths. After patching, review the host for persistence artifacts (unexpected cron entries, modified systemd units, unauthorized SSH keys) in case the flaw was already exploited, and rotate any credentials or secrets that were accessible to the Xray process.

What systems are affected by CVE-2026-55477?

This vulnerability affects the following AI/ML architecture patterns: Not an AI/ML architecture — 3X-UI is a general-purpose proxy/VPN control panel with no genuine connection to model serving, training, RAG, or agent frameworks, Relevant only indirectly: network/proxy infrastructure fronting AI inference or agent services could have its host compromised.

What is the CVSS score for CVE-2026-55477?

CVE-2026-55477 has a CVSS v3.1 base score of 7.2 (HIGH). The EPSS exploitation probability is 0.61%.

What is the AI security impact?

Affected AI Architectures

Not an AI/ML architecture — 3X-UI is a general-purpose proxy/VPN control panel with no genuine connection to model serving, training, RAG, or agent frameworksRelevant only indirectly: network/proxy infrastructure fronting AI inference or agent services could have its host compromised

What are the technical details?

Original Advisory

3X-UI is a web control panel for managing Xray-core servers. Prior to 3.3.1, an authenticated administrator can abuse the database import functionality to achieve arbitrary file write on the host by modifying Xray configuration values stored in the database. This can be leveraged to obtain code execution and persistent access as the user running Xray (including root when Xray is running as root). This vulnerability is fixed in 3.3.1.

Exploitation Scenario

An attacker who has obtained valid 3X-UI administrator credentials (via credential stuffing, phishing, or a separate initial-access foothold) logs into the panel and uses the database import function to inject a crafted Xray configuration value containing a malicious file path and payload. When 3X-UI regenerates the underlying Xray configuration from the database, the manipulated value causes an arbitrary file to be written to the host filesystem — for example a cron job, an SSH authorized_keys entry, or a systemd service file. That file executes with the privileges of the Xray process, frequently root, giving the attacker persistent remote code execution and full control of the host, which they can then use to pivot to any other services running on that machine.

Weaknesses (CWE)

CWE-20 Improper Input Validation Primary CWE-73 External Control of File Name or Path Primary CWE-73 External Control of File Name or Path CWE-73 External Control of File Name or Path

CWE-20 — Improper Input Validation: The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

[Architecture and Design] Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of allowing parser code to be scattered throughout the program, where it could be subject to errors or inconsistencies that create weaknesses. [REF-1109] [REF-1110] [REF-1111]
[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

Source: MITRE CWE corpus.