CVE-2026-33026

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Affected Software

VendorProductVersion RangeStatus
0xJackynginx-ui< 2.3.4affected

Weaknesses

  • CWE-312: CWE-312: Cleartext Storage of Sensitive Information
  • CWE-347: CWE-347: Improper Verification of Cryptographic Signature
  • CWE-354: CWE-354: Improper Validation of Integrity Check Value

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: poc
    • Automatable: yes
    • Technical Impact: total

Additional References

References