CVE-2026-33027

Katalog CVE

CVSS 6.5 · Medium EPSS 0,55%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada nginxui nginx ui. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.

Rincian

Terbit di NVD

30 Maret 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-73: External Control of File Name or Path

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 exploit · advisory vendor
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 product · release notes