A flaw in 3X-UI's database import allows an authenticated administrator to modify Xray configuration entries stored in the database, which the system writes directly to disk. This results in an arbitrary file write that can be leveraged to inject malicious code, giving an attacker code execution rights on the host. The weakness is a classic example of CWE‑73, where unvalidated data from the database is used to form filesystem paths. The impact includes potential persistence as the user that owns the Xray process, and if Xray runs as root, the attacker can gain system‑level privileges.

The affected product is 3x-ui developed by MHSanaei. All releases prior to version 3.3.1 are vulnerable; versions 3.3.1 and later contain the fix.

The CVSS score of 7.2 indicates high severity, but the lack of an available EPSS score makes the likelihood of exploitation uncertain. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that the attacker already has admin authentication to the 3X‑UI interface, after which they can use the import feature and negotiate a file write path to achieve code execution. Because the attack can be performed from the web control panel, it is a network‑based threat that requires no external service. Once exploited, the attacker can maintain persistence until system changes occur.