CVE-2026-84320 0xJacky CVE debrief

Who should care

Nginx UI administrators, security teams, and IT personnel responsible for web server management and security should assess exposure and prioritize remediation. They should review the Nginx UI configuration, verify backup storage directory permissions and access controls, and implement additional security measures to prevent exploitation of this vulnerability.

Why it matters

CVE-2026-84320 is a medium-severity path traversal vulnerability in Nginx UI that allows authenticated users to write archives outside the validated storage directory. Defenders should prioritize remediation and verify backup storage directory permissions and access controls.

• Potential unauthorized file creation with elevated privileges
• Possible exploitation by authenticated users
• Requires verification of backup storage directory permissions and access controls
• Remediation priority for Nginx UI administrators and security teams

Technical summary

The vulnerability exists in the automatic backup feature of Nginx UI, a web user interface for the Nginx web server. An authenticated user can manipulate the backup name to write archives outside the validated storage directory, potentially allowing the creation of files with elevated privileges. This can lead to the creation of files with elevated privileges, potentially allowing an attacker to gain further access to the system. The vulnerability is caused by the AutoBackup.GetName function returning a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embedding that result in the final archive filename.

Defensive priority

Medium priority for Nginx UI administrators and security teams

Recommended defensive actions

• Review and update Nginx UI to version 2.4.3 or later
• Restrict access to the Nginx UI interface to authorized personnel
• Monitor Nginx UI logs for suspicious activity
• Verify backup storage directory permissions and access controls
• Perform a thorough review of the Nginx UI configuration and ensure that all backup storage directories are properly validated
• Check for any suspicious activity in the Nginx UI logs
• Implement additional security measures to prevent exploitation of this vulnerability

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, there is limited information on potential exploits or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.