ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-84320

Nginx UI: Auto backup name allows path traversal outside validated storage path

Published Oct 12, 2026 · catalog updated Oct 15, 2026 · 0xJacky

Check if you run it

No confirmed exploitation is on record for CVE-2026-84320. EPSS is 0.17%. Act only if a listed version of 0xJacky is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.17%
Remediation
Advisory link
Affected products
Go github.com/0xJacky/Nginx-UI · golang github.com · vendor 0xJacky nginx-ui

## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path escapes that storage directory when resolves the embedded traversal sequence. This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent file, to be written outside the intended storage directory with the Nginx UI process privileges. ## Affected Versions - Current branch commit checked: - Latest release checked: , published 2026-04-28 - The vulnerable filename construction is present in both current and . ## Security Boundary The project documentation describes as the critical security boundary for backup operations. It says the setting: - restricts backup operations to explicitly authorized directories, - prevents unauthorized access to sensitive system directories, - enforces administrator-defined boundaries, - normalizes paths to prevent traversal attempts. That boundary is enforced for the configured , but not for the final path after the backup name is appended. ## Root Cause only trims whitespace and replaces spaces: The result is then embedded directly into filenames: and for custom directory backups: The API validation rules require , , , , and , but do not reject , , or in . validates and , but it does not validate the final after appending the generated filename. Relevant paths: - - - - ## Proof of Concept The following local-only reproducer mirrors the relevant code path without contacting any external system: Setup: 1. Create a temporary directory. 2. Set and under that granted directory. 3. Treat only as the allowed path boundary. 4. Use the auto-backup name . 5. Create the custom-directory

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260715121709-f92218e01054
  • golang github.comversion unspecified
  • vendor 0xJacky nginx-uiversion unspecified

How to fix CVE-2026-84320

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-84320. EPSS is 0.17%. Act only if a listed version of 0xJacky is installed.

Which versions are affected?

Compare what you have installed with github.com/0xJacky/Nginx-UI 0 → 1.9.10-0.20260715121709-f92218e01054. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-22: Path Traversal. EPSS 0.17%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

Nginx security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2026 · GitHub Advisory Database

    Detected

    ## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path e

  2. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260715121709-f92218e01054

  3. Oct 15, 2026 · GitHub Advisory Database

    Fix available

    github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260715121709-f92218e01054

  4. Oct 15, 2026 · GitHub Advisory Database

    Updated

    ## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path e

Sources

  • CVE.orgVulnerability recordCVE-2026-84320

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename format

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-84320

    30-day exploitation probability 0.2%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-jrq7-xrjx-pcfw

    GitHub Advisory Database record mirrored by OSV.

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-84320

    Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_pa

    advisories.gitlab.com
  • OpenSSF OSV / OSV ScannerPackage advisoryGHSA-jrq7-xrjx-pcfw

    Nginx UI: Auto backup name allows path traversal outside validated storage path

    osv.dev

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.