CVE-2026-33026

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-312 CWE-347 CWE-354

Affected software

Vendor	Product	Versions
0xJacky	nginx-ui	< 2.3.4

References

https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4Product, Release Notes
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpqExploit, Mitigation, Vendor Advisory
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpqExploit, Mitigation, Vendor Advisory

Timeline

Published: Mar 30, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-330276.5Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded CVE-2026-330287.5Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui application is vulnerable to a Race Conditio CVE-2026-330296.5Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, an input validation vulnerability in the logrotate config CVE-2026-33033.7IBM Concert 1.0 through 3.0.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the CVE-2026-330309.9Nginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Referenc CVE-2026-330318.1Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, a user who was disabled by an administrator can use previ CVE-2026-330329.8Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integratio CVE-2026-330336.5An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. `MultiPartParser` allows remote attackers to degrade CVE-2026-330347.5An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGI requests with a missing or understated `Content-CVE-2026-330356.1WWBN AVideo is an open source video platform. In versions 25.0 and below, there is a reflected XSS vulnerability that allows unauthenticated CVE-2026-330367.5fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Versions 4.0.0-beta.3 through 5.5.5 c CVE-2026-330378.1WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.exam