Input validation error in nginx-ui - #VU157111
Published: October 22, 2026
Vulnerability details
The vulnerability allows a remote user to create or overwrite files within the Nginx configuration tree, disrupt served sites, and potentially execute arbitrary code in Nginx workers.
The vulnerability exists due to improper input validation in the nginx-ui certificate synchronization endpoint when handling certificate synchronization requests. A remote user can send a crafted PUT /api/cert_sync request specifying file paths within the Nginx configuration tree and arbitrary certificate or key content to overwrite configuration files or private keys and trigger an unconditional reload without content validation or an nginx -t syntax check, potentially disrupting services or executing arbitrary code.
Code execution requires an Nginx image that includes the perl, njs, or lua module.