CVE-2026-33027 Details
Description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
A vulnerability in Nginx UI versions through 2.3.3 allows for improper handling of URL-encoded traversal sequences. This flaw enables an authenticated user to craft paths that the backend mistakenly resolves to the base Nginx configuration directory (/etc/nginx). The issue arises because the path normalization process fails to reject traversal attempts, instead directing them to the sensitive configuration directory. Exploiting this vulnerability allows for the deletion of the entire Nginx configuration directory, causing a partial denial-of-service by disrupting Nginx operations and removing all configurations managed by Nginx UI.
Users are advised to update Nginx UI to version 2.3.4, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 | [email protected] | ProductRelease Notes |
| https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nginxui nginx ui | < 2.3.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 1, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | CVE Modified | CISA-ADP |
| Mar 30, 2026 | New CVE Received | [email protected] |