Path Traversal in F5 Nginx Agent
CVE-2026-60062
The NGINX Agent config_dirs directive allows a low-privileged attacker to gain limited read and write access to files outside of the designated secure directory. The config_dirs directive required for this issue can also be configured thro…
Vulnerability class: Path Traversal (Directory Traversal)
CVSS v3 metric
CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N.
Affected products
- F5 Nginx Agent — versions 3.0.0, 2.0.0
- F5 Nginx Instance Manager — versions 2.22.0, 2.17.1
Weakness classification (CWE)
References
- f5sirt@f5.com (vendor-advisory, patch)
Frequently asked questions
- What is CVE-2026-60062?
- CVE-2026-60062 is a medium-severity vulnerability in F5 Nginx Agent, classified under Path Traversal. CVSS score: 6.4/10. Published 2026-07-15.
- How severe is CVE-2026-60062?
- Medium severity. CVSS v3 base score is 6.4 out of 10.