Read the docs
TI-2024-32954 Aliases CVE-2024-49366

Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written

Priority HIGH 73CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00595 48th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nginx-ui (0xJacky): 2.0.0-beta.36

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore 2.0.0-beta.362.0.0-beta.36Patch availableCNA
  • nginx-ui Vendor0xJacky Affected before 2.0.0-beta.36 Fixed in 2.0.0-beta.36 Patch available CNA

CPE configurations NVD · 49

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*up to 1.9.9-4Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:*2.0.0 beta1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:*2.0.0 beta10Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:*2.0.0 beta10_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:*2.0.0 beta11Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta12:*:*:*:*:*:*2.0.0 beta12Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta13:*:*:*:*:*:*2.0.0 beta13Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta13-patch:*:*:*:*:*:*2.0.0 beta13-patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta14:*:*:*:*:*:*2.0.0 beta14Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta15:*:*:*:*:*:*2.0.0 beta15Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions up to 1.9.9-4 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta1:*:*:*:*:*:* Versions 2.0.0 beta1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10:*:*:*:*:*:* Versions 2.0.0 beta10 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta10_patch:*:*:*:*:*:* Versions 2.0.0 beta10_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta11:*:*:*:*:*:* Versions 2.0.0 beta11 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta12:*:*:*:*:*:* Versions 2.0.0 beta12 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta13:*:*:*:*:*:* Versions 2.0.0 beta13 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta13-patch:*:*:*:*:*:* Versions 2.0.0 beta13-patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta14:*:*:*:*:*:* Versions 2.0.0 beta14 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta15:*:*:*:*:*:* Versions 2.0.0 beta15 Vulnerable ·0xJacky
Show 39 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta16:*:*:*:*:*:*2.0.0 beta16Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta17:*:*:*:*:*:*2.0.0 beta17Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18:*:*:*:*:*:*2.0.0 beta18Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18-patch1:*:*:*:*:*:*2.0.0 beta18-patch1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18-patch2:*:*:*:*:*:*2.0.0 beta18-patch2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta19:*:*:*:*:*:*2.0.0 beta19Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:*2.0.0 beta2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta20:*:*:*:*:*:*2.0.0 beta20Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta21:*:*:*:*:*:*2.0.0 beta21Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta22:*:*:*:*:*:*2.0.0 beta22Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23:*:*:*:*:*:*2.0.0 beta23Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23-patch1:*:*:*:*:*:*2.0.0 beta23-patch1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23-ptach2:*:*:*:*:*:*2.0.0 beta23-ptach2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta24:*:*:*:*:*:*2.0.0 beta24Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25:*:*:*:*:*:*2.0.0 beta25Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25-patch1:*:*:*:*:*:*2.0.0 beta25-patch1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25-ptach2:*:*:*:*:*:*2.0.0 beta25-ptach2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta27:*:*:*:*:*:*2.0.0 beta27Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta28:*:*:*:*:*:*2.0.0 beta28Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta29:*:*:*:*:*:*2.0.0 beta29Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:*2.0.0 beta3Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta30:*:*:*:*:*:*2.0.0 beta30Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta31:*:*:*:*:*:*2.0.0 beta31Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta32:*:*:*:*:*:*2.0.0 beta32Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta32-patch1:*:*:*:*:*:*2.0.0 beta32-patch1Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta33:*:*:*:*:*:*2.0.0 beta33Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta34:*:*:*:*:*:*2.0.0 beta34Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta35:*:*:*:*:*:*2.0.0 beta35Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:*2.0.0 beta4Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:*2.0.0 beta4_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:*2.0.0 beta5Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:*2.0.0 beta5_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:*2.0.0 beta6Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:*2.0.0 beta6_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:*2.0.0 beta6_patch2Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:*2.0.0 beta7Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:*2.0.0 beta8Vulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:*2.0.0 beta8_patchVulnerable0xJacky
cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:*2.0.0 beta9Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta16:*:*:*:*:*:* Versions 2.0.0 beta16 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta17:*:*:*:*:*:* Versions 2.0.0 beta17 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18:*:*:*:*:*:* Versions 2.0.0 beta18 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18-patch1:*:*:*:*:*:* Versions 2.0.0 beta18-patch1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta18-patch2:*:*:*:*:*:* Versions 2.0.0 beta18-patch2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta19:*:*:*:*:*:* Versions 2.0.0 beta19 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta2:*:*:*:*:*:* Versions 2.0.0 beta2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta20:*:*:*:*:*:* Versions 2.0.0 beta20 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta21:*:*:*:*:*:* Versions 2.0.0 beta21 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta22:*:*:*:*:*:* Versions 2.0.0 beta22 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23:*:*:*:*:*:* Versions 2.0.0 beta23 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23-patch1:*:*:*:*:*:* Versions 2.0.0 beta23-patch1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta23-ptach2:*:*:*:*:*:* Versions 2.0.0 beta23-ptach2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta24:*:*:*:*:*:* Versions 2.0.0 beta24 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25:*:*:*:*:*:* Versions 2.0.0 beta25 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25-patch1:*:*:*:*:*:* Versions 2.0.0 beta25-patch1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta25-ptach2:*:*:*:*:*:* Versions 2.0.0 beta25-ptach2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta27:*:*:*:*:*:* Versions 2.0.0 beta27 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta28:*:*:*:*:*:* Versions 2.0.0 beta28 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta29:*:*:*:*:*:* Versions 2.0.0 beta29 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta3:*:*:*:*:*:* Versions 2.0.0 beta3 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta30:*:*:*:*:*:* Versions 2.0.0 beta30 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta31:*:*:*:*:*:* Versions 2.0.0 beta31 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta32:*:*:*:*:*:* Versions 2.0.0 beta32 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta32-patch1:*:*:*:*:*:* Versions 2.0.0 beta32-patch1 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta33:*:*:*:*:*:* Versions 2.0.0 beta33 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta34:*:*:*:*:*:* Versions 2.0.0 beta34 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta35:*:*:*:*:*:* Versions 2.0.0 beta35 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4:*:*:*:*:*:* Versions 2.0.0 beta4 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta4_patch:*:*:*:*:*:* Versions 2.0.0 beta4_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5:*:*:*:*:*:* Versions 2.0.0 beta5 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta5_patch:*:*:*:*:*:* Versions 2.0.0 beta5_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6:*:*:*:*:*:* Versions 2.0.0 beta6 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch:*:*:*:*:*:* Versions 2.0.0 beta6_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta6_patch2:*:*:*:*:*:* Versions 2.0.0 beta6_patch2 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta7:*:*:*:*:*:* Versions 2.0.0 beta7 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8:*:*:*:*:*:* Versions 2.0.0 beta8 Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta8_patch:*:*:*:*:*:* Versions 2.0.0 beta8_patch Vulnerable ·0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:2.0.0:beta9:*:*:*:*:*:* Versions 2.0.0 beta9 Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.0.0-beta.36

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49366

References

Exploit 1

Other 1

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences