CVE-2025-29331

An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check certificate option to wget when downloading updates

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2025-06-26

Last modified

2025-06-26

Weaknesses

CWE-295

Affected products

• 3x-ui (Mhsanaei)

References

• https://github.com/MHSanaei/3x-ui/pull/2661
• https://www.digilol.net/security-advisories/dlsec2025-001.html