Remote Code Execution Vulnerability in MHSanaei 3x-ui Software
CVE-2025-29331

9.8CRITICAL

Key Information:

Vendor

MHSanaei

Status
3x-ui
Vendor
CVE Published:
26 June 2025

What is CVE-2025-29331?

A vulnerability exists in MHSanaei's 3x-ui prior to version 2.5.3, allowing remote attackers to execute arbitrary code. This occurs due to improper handling of certificate checks in the management script, which passes the no check certificate option to wget when fetching updates. As a result, an attacker can exploit this flaw to execute malicious code on the affected system, posing significant security risks.

References

https://www.digilol.net/security-advisories/dlsec2025-001...
https://github.com/MHSanaei/3x-ui/pull/2661

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.