SB2026071788 - Multiple vulnerabilities in nginx-ui

Description

This security bulletin contains information about 2 vulnerabilities.

1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in config.ValidateConfigFile when processing nginx configuration content. A remote user can place a benign directive before a semicolon-separated restricted directive on the same line to execute arbitrary code.

Exploitation requires authentication such as a node secret or user JWT. On deployments without the required modules, the issue can cause a failed reload instead of code execution.

2) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in the MCP nginx_config_add tool when processing caller-supplied nginx configuration content. A remote user can submit crafted nginx directives to execute arbitrary code.

Code execution is achievable on deployments where the njs or perl module is available, including the official Docker image. On stock nginx without those modules, the issue can still cause a denial of service by triggering a failed reload. The vulnerable write path is limited to the nginx configuration directory, but the main nginx.conf file within that directory can be overwritten.

Remediation

Install update from vendor's website.

References

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-76pm-mq2q-9gcr
• https://github.com/0xJacky/Nginx-UI/commit/3e411d38