CVE-2026-33026

Katalog CVE

CVSS 9.1 · Critical EPSS 0,21%

Kerentanan Cleartext Storage of Sensitive Information pada nginxui nginx ui. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-312: Cleartext Storage of Sensitive Information
CWE-347: Improper Verification of Cryptographic Signature
CWE-354: Improper Validation of Integrity Check Value

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq exploit · mitigasi · advisory vendor
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 product · release notes