PT-2026-47446 · Nginxproxymanager · Nginx Proxy Manager

Yassine Damiri · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-40519

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to execute arbitrary commands by storing a malicious payload in the dns provider credentials field. The user-controlled dns provider credentials value is interpolated directly into a shell command executed via child process.exec() without sanitization or escaping, causing the injected command to execute upon backend restart.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-40519

Affected Products

Nginx Proxy Manager

References · 4

• https://github.com/NginxProxyManager/nginx-proxy-manager/commit/a5db5ed156355e3088e7d1ceb0533d4bae922def · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-40519 · Security Note
• https://github.com/NginxProxyManager/nginx-proxy-manager/pull/5498 · Note
• https://vulncheck.com/advisories/nginx-proxy-manager-authenticated-rce-via-setupcertbotplugins · Note