CVE-2026-33027 in 0xJacky nginx-ui

Сводка (Английский)

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.

Ответственный

GitHub_M

Резервировать

17.03.2026

Раскрытие

30.03.2026

Записи

VulDB provides additional information and datapoints for this CVE:

ИД	Уязвимость	CWE	Экс	Кон	CVE
354236	0xJacky nginx-ui обход каталога	22	Не определено	Официальное исправление	CVE-2026-33027