Path Traversal in 0xjacky Nginx-ui

CVE-2026-33027

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the b…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.001 (21.1th percentile) — read the EPSS interpretation.

Affected products

0xjacky Nginx-ui — versions < 2.3.4

Weakness classification (CWE)

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357 (x_refsource_CONFIRM)
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 (x_refsource_MISC)