Path traversal in nginx-ui - CVE-2026-84320
Published: August 14, 2026 / Updated: October 16, 2026
Vulnerability identifier: #VU142580
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-84320
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to write files outside the intended backup storage directory.
The vulnerability exists due to path traversal in auto-backup filename generation when handling a user-controlled auto-backup name. A remote user can create or modify an auto-backup task with crafted path traversal sequences in the name to write files outside the intended backup storage directory.
For encrypted configuration backups, the adjacent .key file may also be written outside the intended storage directory with the application process privileges.
Affected software
nginx-ui
How to mitigate CVE-2026-84320
Install security update from vendor's website.
nginx-ui - update to 2.3.11