PT-2026-29088 · Nginx-Ui · Nginx-Ui
Dapickle
·
Published
2026-03-30
·
Updated
2026-04-07
·
CVE-2026-33027
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Nginx UI versions prior to 2.3.4
Description
Nginx UI improperly handles URL-encoded traversal sequences in its configuration, potentially leading to a partial Denial of Service. Specifically, specially crafted paths can cause the backend to resolve to the base Nginx configuration directory (/etc/nginx) and execute operations on it. An authenticated user can exploit this to remove the entire /etc/nginx directory. The issue stems from improper path canonicalization, unsafe fallback logic, and an unsafe deletion primitive that recursively removes directories without sufficient safeguards. The vulnerability is triggered by traversal sequences like
..%252F that bypass initial filters and cause the clamping mechanism to resolve paths to the base configuration directory. The deletion handler then uses os.RemoveAll to recursively delete the resolved path.Recommendations
Update to Nginx UI version 2.3.4 or later.
Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Nginx-Ui