CVE-2026-33027

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-33027
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 Product Release Notes
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 Exploit Vendor Advisory
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 Exploit Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*
History

01 Apr 2026, 18:33

Type Values Removed Values Added
First Time Nginxui nginx Ui
Nginxui
References () https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 - () https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 - Product, Release Notes
References () https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 - () https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 - Exploit, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*

01 Apr 2026, 14:24

Type Values Removed Values Added
Summary
  • (es) Nginx UI es una interfaz de usuario web para el servidor web Nginx. Antes de la versión 2.3.4, la configuración de nginx-ui maneja incorrectamente las secuencias de recorrido codificadas en URL. Cuando se proporcionan rutas especialmente diseñadas, el backend las resuelve al directorio base de configuración de Nginx y ejecuta la operación en el directorio base (/etc/nginx). En particular, esto permite a un usuario autenticado eliminar todo el directorio /etc/nginx, lo que resulta en una Denegación de Servicio parcial. Este problema ha sido parcheado en la versión 2.3.4.

30 Mar 2026, 19:16

Type Values Removed Values Added
References () https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 - () https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 -

30 Mar 2026, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-30 18:16

Updated : 2026-04-01 18:33

NVD link : CVE-2026-33027

Mitre link : CVE-2026-33027

CVE.ORG link : CVE-2026-33027

JSON object : View

Products Affected

nginxui

  • nginx_ui
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CWE-73

External Control of File Name or Path