CVE-2026-84320
Nginx UI: Auto backup name allows path traversal outside validated storage path
Published Oct 12, 2026 · updated Oct 15, 2026 · 0xJacky nginx-ui
## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path escapes that storage directory when resolves the embedded traversal sequence. This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent file, to be written outside the intended storage directory with the Nginx UI process privileges. ## Affected Versions - Current branch commit checked: - Latest release checked: , published 2026-04-28 - The vulnerable filename construction is present in both current and . ## Security Boundary The project documentation describes as the critical security boundary for backup operations. It says the setting: - restricts backup operations to explicitly authorized directories, - prevents unauthorized access to sensitive system directories, - enforces administrator-defined boundaries, - normalizes paths to prevent traversal attempts. That boundary is enforced for the configured , but not for the final path after the backup name is appended. ## Root Cause only trims whitespace and replaces spaces: The result is then embedded directly into filenames: and for custom directory backups: The API validation rules require , , , , and , but do not reject , , or in . validates and , but it does not validate the final after appending the generated filename. Relevant paths: - - - - ## Proof of Concept The following local-only reproducer mirrors the relevant code path without contacting any external system: Setup: 1. Create a temporary directory. 2. Set and under that granted directory. 3. Treat only as the allowed path boundary. 4. Use the auto-backup name . 5. Create the custom-directory
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path e
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260715121709-f92218e01054
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260715121709-f92218e01054
Oct 15, 2026 · GitHub Advisory Database
Updated
## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path e
Affected
- Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260715121709-f92218e01054
- golang github.comversion unspecified
- vendor 0xJacky nginx-uiversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-84320
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename format
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-jrq7-xrjx-pcfw
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-84320
Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_pa
advisories.gitlab.com - OSV.devPackage advisoryGHSA-jrq7-xrjx-pcfw
Nginx UI: Auto backup name allows path traversal outside validated storage path
osv.dev