CVE-2026-84320

Nginx UI: Auto backup name allows path traversal outside validated storage path

Published Oct 12, 2026 · corrected/updated Oct 15, 2026 · 0xJacky nginx-ui · evidence confidence high

## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path escapes that storage directory when resolves the embedded traversal sequence. This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent file, to be written outside the intended storage directory with the Nginx UI process privileges. ## Affected Versions - Current branch commit checked: - Latest release checked: , published 2026-04-28 - The vulnerable filename construction is present in both current and . ## Security Boundary The project documentation describes as the critical security boundary for backup operations. It says the setting: - restricts backup operations to explicitly authorized directories, - prevents unauthorized access to sensitive system directories, - enforces administrator-defined boundaries, - normalizes paths to prevent traversal attempts. That boundary is enforced for the configured , but not for the final path after the backup name is appended. ## Root Cause only trims whitespace and replaces spaces: The result is then embedded directly into filenames: and for custom directory backups: The API validation rules require , , , , and , but do not reject , , or in . validates and , but it does not validate the final after appending the generated filename. Relevant paths: - - - - ## Proof of Concept The following local-only reproducer mirrors the relevant code path without contacting any external system: Setup: 1. Create a temporary directory. 2. Set and under that granted directory. 3. Treat only as the allowed path boundary. 4. Use the auto-backup name . 5. Create the custom-directory

Grounded briefings

Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.

Executive

CVE-2026-84320 is a medium public vulnerability record for 0xJacky nginx-ui. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.

System administrator

Identify whether 0xJacky nginx-ui is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: github.com/0xJacky/Nginx-UI (0 → 1.9.10-0.20260715121709-f92218e01054); github.com; 0xJacky nginx-ui. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.

Security analyst

Signals on file: CVSS 6.3. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-22. Sources contributing to this record: cve_org, github, gitlab, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.

Exploitation and remediation

Exploitation evidence
Not listed as known exploited in CISA KEV. Not in the CISA KEV catalog.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Technology hubs

Nginx

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

Oct 15, 2026 · GitHub Advisory Database
Detected
## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path e
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260715121709-f92218e01054
Oct 15, 2026 · GitHub Advisory Database
Fix available
github.com/0xJacky/Nginx-UI fixed in 1.9.10-0.20260715121709-f92218e01054
Oct 15, 2026 · GitHub Advisory Database
Updated
## Summary Nginx UI validates and against the administrator-defined boundary, but the final auto-backup output filename is built from the user-controlled auto-backup without stripping path separators or components. An authenticated user who can create or modify an auto-backup task can set a name such as . The configured still passes validation because it is inside , but the generated backup path e

Affected

Go github.com/0xJacky/Nginx-UI0 → 1.9.10-0.20260715121709-f92218e01054
golang github.comversion unspecified
vendor 0xJacky nginx-uiversion unspecified

Sources

CVE.orgVulnerability recordCVE-2026-84320
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename format
cve.org
GitHub Advisory DatabasePackage advisoryGHSA-jrq7-xrjx-pcfw
GitHub Advisory Database record mirrored by OSV.
github.com
GitLab Advisory DatabasePackage advisoryCVE-2026-84320
Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components. An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_pa
advisories.gitlab.com
OSV.devPackage advisoryGHSA-jrq7-xrjx-pcfw
Nginx UI: Auto backup name allows path traversal outside validated storage path
osv.dev