CVE-2025-29331: Mhsanaei 3x-UI

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passes the no check certificate option to wget when downloading updates

Affected products

• Mhsanaei 3x-UI: before 2.5.3 (fixed in 2.5.3)

Published 2025-06-26. Last modified 2026-06-17.