{"id":"CVE-2026-84320","revision":null,"records":[{"revision":"a2a4f384067546c392e27827af0a6df0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-84320","aliases":[],"title":"Nginx UI: Auto backup name allows path traversal outside validated storage path","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.","state":0,"publishedAt":"2026-10-12T20:44:39.471+00:00","modifiedAt":"2026-10-13T20:24:05.329+00:00","affected":[{"ecosystem":"Vendor product","name":"nginx-ui","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"0xJacky\",\n                    \"product\": \"nginx-ui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.4.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw","https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb","https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84320","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-84320","identifiers":["CVE-2026-84320"]},"retained":false,"historicalAffected":[]},{"revision":"fcb3c85d8bcf4e69aefe37e098e9df1c","observedAt":"2026-11-07T15:21:55.48+00:00","statement":{"source":"euvd","id":"EUVD-2026-97860","aliases":["CVE-2026-84320","GHSA-jrq7-xrjx-pcfw"],"title":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory co…","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3,"severity":null}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw","https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb","https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-97860","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 12, 2026, 8:44:39 PM","dateUpdated":"Oct 13, 2026, 8:24:05 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-97860","identifiers":["EUVD-2026-97860","CVE-2026-84320","GHSA-jrq7-xrjx-pcfw"]},"retained":false,"historicalAffected":[]},{"revision":"4fe28bea398f4a25bb38ace4a0aa7a6e","observedAt":"2026-10-25T16:19:16.24+00:00","statement":{"source":"nvd","id":"CVE-2026-84320","aliases":[],"title":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory co…","description":"Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.","state":0,"publishedAt":"2026-10-12T21:17:22.663+00:00","modifiedAt":"2026-10-13T21:19:11.537+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":6.3,"severity":"MEDIUM"}],"references":["https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb","https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3","https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84320","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-22"],"productCriteria":[],"sourceDates":{"published":"2026-10-12T21:17:22.663","lastModified":"2026-10-13T21:19:11.537"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-84320","identifiers":["CVE-2026-84320"]},"retained":false,"historicalAffected":[]},{"revision":"1f12b42952db4265bad9e105eca5ef77","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jrq7-xrjx-pcfw","aliases":["CVE-2026-84320","GO-2026-6788"],"title":"Nginx UI: Auto backup name allows path traversal outside validated storage path","description":"## Summary\n\nNginx UI validates `backup_path` and `storage_path` against the administrator-defined `backup.GrantedAccessPath` boundary, but the final auto-backup output filename is built from the user-controlled auto-backup `name` without stripping path separators or `..` components.\n\nAn authenticated user who can create or modify an auto-backup task can set a name such as `task/../../../escaped`. The configured `storage_path` still passes validation because it is inside `GrantedAccessPath`, but the generated backup path escapes that storage directory when `filepath.Join(storage_path, filename)` resolves the embedded traversal sequence.\n\nThis bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent `.key` file, to be written outside the intended storage directory with the Nginx UI process privileges.\n\n## Affected Versions\n\n- Current `dev` branch commit checked: `4948fba8744e82c3d7003f68ee164e9f49421066`\n- Latest release checked: `v2.3.10`, published 2026-04-28\n- The vulnerable filename construction is present in both current `dev` and `v2.3.10`.\n\n## Security Boundary\n\nThe project documentation describes `backup.GrantedAccessPath` as the critical security boundary for backup operations. It says the setting:\n\n- restricts backup operations to explicitly authorized directories,\n- prevents unauthorized access to sensitive system directories,\n- enforces administrator-defined boundaries,\n- normalizes paths to prevent traversal attempts.\n\nThat boundary is enforced for the configured `storage_path`, but not for the final path after the backup name is appended.\n\n## Root Cause\n\n`model.AutoBackup.GetName()` only trims whitespace and replaces spaces:\n\n```go\nfunc (a *AutoBackup) GetName() string {\n    return strings.ReplaceAll(strings.TrimSpace(a.Name), \" \", \"_\")\n}\n```\n\nThe result is then embedded directly into filenames:\n\n```go\nfilename := fmt.Sprintf(\"%s_%d.zip\", autoBackup.GetName(), time.Now().Unix())\noutputPath = filepath.Join(autoBackup.StoragePath, filename)\n```\n\nand for custom directory backups:\n\n```go\nfilename := fmt.Sprintf(\"custom_dir_%s_%d.zip\", autoBackup.GetName(), time.Now().Unix())\noutputPath = filepath.Join(autoBackup.StoragePath, filename)\n```\n\nThe API validation rules require `name`, `backup_type`, `storage_type`, `storage_path`, and `cron_expression`, but do not reject `/`, `\\`, or `..` in `name`. `ValidateAutoBackupConfig` validates `backup_path` and `storage_path`, but it does not validate the final `outputPath` after appending the generated filename.\n\nRelevant paths:\n\n- `model/auto_backup.go`\n- `api/backup/auto_backup.go`\n- `internal/backup/auto_backup.go`\n- `internal/backup/utils.go`\n\n## Proof of Concept\n\nThe following local-only reproducer mirrors the relevant code path without contacting any external system:\n\n```go\nname := \"task/../../../escaped\"\nfilename := fmt.Sprintf(\"custom_dir_%s_%d.zip\", getName(name), int64(1715555555))\noutputPath := filepath.Join(storageDir, filename)\n```\n\nSetup:\n\n1. Create a temporary `granted` directory.\n2. Set `sourceDir` and `storageDir` under that granted directory.\n3. Treat only `granted` as the allowed path boundary.\n4. Use the auto-backup name `task/../../../escaped`.\n5. Create the custom-directory backup using the same filename pattern and zip creation behavior.\n\nObserved output:\n\n```text\ngranted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted\nvalidated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage\nauto_backup_name=\"task/../../../escaped\"\nconstructed_filename=\"custom_dir_task/../../../escaped_1715555555.zip\"\ncreated_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip\nescaped_validated_storage_path=true\ncreated_file_exists=true\n```\n\nThe configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory.\n\nA repo-local regression test was also prepared at:\n\n```text\ninternal/backup/auto_backup_path_traversal_poc_test.go\n```\n\nThe test cannot currently be executed cleanly in this checkout because unrelated build prerequisites fail before the package test runs:\n\n```text\napp/app.go: pattern all:dist: no matching files found\nmodel/cert.go: no required module provides package github.com/go-acme/lego/v5/certificate\ninternal/helper/key_type.go: no required module provides package github.com/go-acme/lego/v5/certcrypto\n```\n\nThe standalone reproducer output above was therefore used as the executable proof for this report.\n\n## Impact\n\nAn authenticated user with access to the auto-backup API can bypass the administrator-configured backup storage boundary. Depending on filesystem permissions and deployment layout, this can:\n\n- write backup archives outside the intended `storage_path`,\n- write encrypted configuration backup key files outside the intended `storage_path`,\n- place sensitive backup material in directories that administrators did not authorize for backup storage,\n- create or overwrite timestamp-suffixed files outside the validated backup directory using the Nginx UI process privileges.\n\nThis is especially relevant because backup archives may contain Nginx UI configuration, database files, Nginx configuration, and for encrypted config backups the adjacent key file required to decrypt the archive.\n\n## Suggested Fix\n\nRecommended defense in depth:\n\n1. Treat auto-backup `name` as a display label only, not as a filesystem path component.\n2. Sanitize generated filenames with `filepath.Base` or a strict allowlist such as `[A-Za-z0-9._-]`.\n3. Reject path separators, drive separators, NUL bytes, and `..` segments in `name`.\n4. After constructing `outputPath`, clean it and validate that the final path remains inside the already-validated `storage_path`.\n5. Add regression tests for both local and S3 temporary-file paths.\n\nExample invariant:\n\n```go\ncleanOutput := filepath.Clean(outputPath)\ncleanStorage := filepath.Clean(autoBackup.StoragePath) + string(filepath.Separator)\nif !strings.HasPrefix(cleanOutput, cleanStorage) {\n    return ErrPathNotInGrantedAccess\n}\n```\n\n## Disclosure Notes\n\nThis was tested only in a local isolated environment against source code and temporary directories. No online demo systems or production systems were tested.\n\nAI assistance was used to inspect the open-source code, prepare the local reproducer, and draft this report. The issue and PoC output were verified locally before submission.","state":0,"publishedAt":"2026-10-15T20:10:56+00:00","modifiedAt":"2026-10-19T21:40:47.0373155+00:00","affected":[{"ecosystem":"Go","name":"github.com/0xJacky/Nginx-UI","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.10-0.20260715121709-f92218e01054"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw","https://nvd.nist.gov/vuln/detail/CVE-2026-84320","https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb","https://github.com/0xJacky/nginx-ui","https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"],"sourceUrl":"https://github.com/advisories/GHSA-jrq7-xrjx-pcfw","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jrq7-xrjx-pcfw","identifiers":["GHSA-jrq7-xrjx-pcfw","CVE-2026-84320","GO-2026-6788"]},"retained":false,"historicalAffected":[]},{"revision":"eac58218be1f4b85bf974344873782b1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6788","aliases":["CVE-2026-84320","GHSA-jrq7-xrjx-pcfw"],"title":"Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI","description":"Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI","state":0,"publishedAt":"2026-10-19T21:08:35+00:00","modifiedAt":"2026-10-19T21:31:50.6197317+00:00","affected":[{"ecosystem":"Go","name":"github.com/0xJacky/Nginx-UI","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.9.10-0.20260715121709-f92218e01054"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw","https://nvd.nist.gov/vuln/detail/CVE-2026-84320","https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb","https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6788","license":"OSV · upstream source license applies","key":"osv:GO-2026-6788","identifiers":["GO-2026-6788","CVE-2026-84320","GHSA-jrq7-xrjx-pcfw"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8442875+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8442884+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-4b0775bb0fc73c3ceeed66f8f17640894d61d654f97ee9386046b283ad9f9876","complete":true,"records":421100,"lastAttemptAt":"2026-11-08T14:04:21.1432513+00:00","lastSuccessAt":"2026-11-08T14:04:21.1228768+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.1432513+00:00","snapshotPublishedAt":"2026-11-08T13:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-383c643166b94ac4b6a615647191978e","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T14:04:47.6384375+00:00","lastSuccessAt":"2026-11-08T13:04:50.073+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:50.073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8452187+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8452194+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceefbd28b79c4b75ac56c9c678246411","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T14:04:46.9956646+00:00","lastSuccessAt":"2026-11-08T14:04:46.992+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:46.992+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13185,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T14:04:21.5047325+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.5047325+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T14:04:21.2941446+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.2941446+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T14:04:21.6167179+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.6167179+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T14:04:21.3943214+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.3943214+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}