Read the docs
TI-2026-25472 Aliases CVE-2026-33026GHSA-fhh2-gg7w-gwpq

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Priority HIGH 82CWE-312Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-312 and CWE-347.

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nginx-ui (0xJacky): 2.3.4github.com/0xJacky/Nginx-UI (Go): 1.9.10-0.20260315015203-f61bcec547c0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore 2.3.42.3.4Patch availableCNA
—github.com/0xJacky/Nginx-UI (Go)before 1.9.10-0.20260315015203-f61bcec547c01.9.10-0.20260315015203-f61bcec547c0Patch availableGHSA-fhh2-gg7w-gwpq
  • nginx-ui Vendor0xJacky Affected before 2.3.4 Fixed in 2.3.4 Patch available CNA
  • github.com/0xJacky/Nginx-UI (Go) Vendor— Affected before 1.9.10-0.20260315015203-f61bcec547c0 Fixed in 1.9.10-0.20260315015203-f61bcec547c0 Patch available GHSA-fhh2-gg7w-gwpq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*before 2.3.4Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions before 2.3.4 Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.3.4
  • Fix · GHSA-fhh2-gg7w-gwpq github.com/0xJacky/Nginx-UI (Go) Fixed in 1.9.10-0.20260315015203-f61bcec547c0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33026
  2. 2026-10-03 Alias added: GHSA-fhh2-gg7w-gwpq

References

Exploit 1

Advisory 2

Other 4

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
  • TI-2026-30543 nginx-ui: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover CVSS 3.1CRITICAL 9.8
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences