Vendor
An authenticated administrator in 3x-ui can abuse log configuration settings to achieve arbitrary file writes, potentially leading to persistent access or code execution as the Xray process user.