Nginxui vulnerabilities, page 2
32 vulnerabilities
Known vulnerabilities in Nginxui products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
RoutineCVE-2026-330290xjacky · nginx-ui +2 moreNginx UI: DoS via Negative Integer Input in Logrotate IntervalNginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate configuration allows an authenticated user to cause a complete Denial of Service (DoS). By submitting a negative integer for the rotation interval, the backend enters an infinite loop or an invalid state, rendering the web interface unresponsive. This issue has been patched in version 2.3.4.CVSS6.9MediumEPSS0.98%PrioritiseCVE-2026-330300xjacky · nginx-ui +2 moreNginx UI: Unencrypted Storage of DNS API Tokens and ACME Private KeysNginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user to access, modify, and delete resources belonging to other users. The application's base Model struct lacks a user_id field, and all resource endpoints perform queries by ID without verifying user ownership, enabling complete authorization bypass in multi-user environments. At time of publication, there are no publicly available patches.CVSS9.9CriticalEPSS0.29%PrioritiseCVE-2026-330320xjacky · nginx-ui +2 moreNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverNginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthRequired() middleware), the /mcp_message endpoint only applies IP whitelisting - and the default IP whitelist is empty, which the middleware treats as "allow all". This means any network attacker can invoke all MCP tools without authentication, including restarting nginx, creating/modifying/deleting nginx configuration files, and triggering automatic config reloads - achieving complete nginx service takeover. At time of publication, there are no publicly available patches.CVSS9.8CriticalEPSS35.27%PrioritiseCVE-2026-279440xjacky · nginx-ui +2 moreNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureNginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.CVSS9.8CriticalEPSS22.84%PrioritiseCVE-2024-493680xjacky · nginx-ui +1 moreUnchecked logrotate settings lead to arbitrary command executionNginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.CVSS9.8CriticalEPSS27.67%RoutineCVE-2024-493670xjacky · nginx-ui +1 moreNginx UI's log path can be controlledNginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.CVSS7.5HighEPSS0.64%PrioritiseCVE-2024-493660xjacky · nginx-ui +1 moreNginx UI's json field can construct a directory traversal payload, causing arbitrary files to be writtenNginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.CVSS7.7HighEPSS0.60%RoutineCVE-2024-238280xjacky · nginx-ui +2 moreNginx-UI authenticated RCE through injecting into the application config via CRLFNginx-UI is a web interface to manage Nginx configurations. It is vulnerable to an authenticated arbitrary command execution via CRLF attack when changing the value of test_config_cmd or start_cmd. This vulnerability exists due to an incomplete fix for CVE-2024-22197 and CVE-2024-22198. This vulnerability has been patched in version 2.0.0.beta.12.CVSS8.8HighEPSS1.05%PrioritiseCVE-2024-238270xjacky · nginx-ui +2 moreNginx-UI arbitrary file write through the Import Certificate featureNginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.CVSS9.8CriticalEPSS0.70%PrioritiseCVE-2024-221980xjacky · nginx-ui +2 moreAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)Nginx-UI is a web interface to manage Nginx configurations. It is vulnerable to arbitrary command execution by abusing the configuration settings. The `Home > Preference` page exposes a list of system settings such as `Run Mode`, `Jwt Secret`, `Node Secret` and `Terminal Start Command`. While the UI doesn't allow users to modify the `Terminal Start Command` setting, it is possible to do so by sending a request to the API. This issue may lead to authenticated remote code execution, privilege escalation, and information disclosure. This vulnerability has been patched in version 2.0.0.beta.9.CVSS8.8HighEPSS4.06%PrioritiseCVE-2024-221960xjacky · nginx-ui +2 moreAuthenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)Nginx-UI is an online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using `DefaultQuery`, the `"desc"` and `"id"` values are used as default values if the query parameters are not set. Thus, the `order` and `sort_by` query parameter are user-controlled and are being appended to the `order` variable without any sanitization. This issue has been patched in version 2.0.0.beta.9.CVSS7.0HighEPSS0.58%PrioritiseCVE-2024-221970xjacky · nginx-ui +2 moreAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)Nginx-ui is online statistics for Server Indicators Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.CVSS8.8HighEPSS1.54%