CVE-2026-33027: Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory

Vulnerability summary

CVE-2026-33027 is a medium (CVSS 6.9) vulnerability in 0xjacky nginx-ui. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 30-03-2026
   PublishedVulnerability first disclosed.
2. 30-03-2026
   Last modifiedVulnerability information updated.

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.