PT-2026-29103 · 0Xjacky · Nginx-Ui

Published 2026-03-30 · Updated 2026-03-30 · CVE-2026-33026

NVD

CVSS v4.0

9.4

Critical

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Fix

Improper Verification of Cryptographic Signature

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-347

CWE-312

CWE-354

Related Identifiers

CVE-2026-33026

Affected Products

Nginx-Ui

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-33026 · Security Note
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq · Note
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 · Note