CVE-2026-84320

Received Received - Intake

Path Traversal in Nginx UI

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: GitHub, Inc.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-12

Last Modified

2026-10-12

Generated

2026-10-13

AI Q&A

2026-10-13

EPSS Evaluated

N/A

NVD

CVE-2026-84320

Affected Vendors & Products

Vendor	Product	Version / Range
0xJacky	nginx-ui	< 2.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Nginx UI before version 2.4.3 has a flaw where it validates the storage path for automatic backups but fails to properly sanitize user-controlled backup names. This allows an authenticated user to craft a malicious backup name containing path separators or parent-directory components, which can cause backup files to be written outside the intended storage directory. The vulnerability stems from improper handling of the AutoBackup.GetName function and downstream filename formatting.

Detection Guidance

Check Nginx UI version for versions prior to 2.4.3. Inspect backup configurations for user-controlled paths containing path separators or parent-directory components. Review file system permissions for Nginx UI process to detect unauthorized file writes outside intended directories.

Impact Analysis

An attacker with authenticated access could exploit this to write backup archives or encryption key files outside the intended directory, potentially gaining unauthorized file access or overwriting critical system files. This could lead to data leakage, service disruption, or privilege escalation if the Nginx UI process has elevated privileges.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, violating confidentiality and integrity requirements in GDPR and HIPAA. If backup files containing personal or health data are written outside controlled directories, it may result in non-compliance with data protection obligations, including breach notification requirements.

Mitigation Strategies

Upgrade Nginx UI to version 2.4.3 or later immediately. Review and restrict user permissions for backup configuration changes. Audit file system for unauthorized files created by Nginx UI process and remove them.

Hi! I’m here to help you understand CVE-2026-84320. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70