{"id":"GO-2026-6284","revision":"023e8df8609a495da319307faed19d44","records":[{"revision":"023e8df8609a495da319307faed19d44","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6284","aliases":["CVE-2026-55477","GHSA-jm48-m3rr-9hgg"],"title":"3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui","description":"3X-UI Vulnerable to Authenticated Arbitrary File Write via Database Import and Xray Log Path Manipulation in github.com/mhsanaei/3x-ui","state":0,"publishedAt":"2026-08-25T19:43:10+00:00","modifiedAt":"2026-08-26T01:21:40.8536733+00:00","affected":[{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/mhsanaei/3x-ui/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.3.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/MHSanaei/3x-ui/security/advisories/GHSA-jm48-m3rr-9hgg","https://nvd.nist.gov/vuln/detail/CVE-2026-55477","https://github.com/MHSanaei/3x-ui/commit/80e168787ed608e83a065033ee94c8bfc3025ce7","https://github.com/MHSanaei/3x-ui/releases/tag/v3.3.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6284","license":"OSV · upstream source license applies","key":"osv:GO-2026-6284","identifiers":["GO-2026-6284","CVE-2026-55477","GHSA-jm48-m3rr-9hgg"]},"retained":false,"historicalAffected":[]}],"coverage":[]}