Nginx UI: Auto backup name allows path traversal outside validated storage path

## Summary Nginx UI validates `backup_path` and `storage_path` against the administrator-defined `backup.GrantedAccessPath` boundary, but the final auto-backup output filename is built from the user-controlled auto-backup `name` without stripping path separators or `..` components. An authenticated user who can create or modify an auto-backup task can set a name such as `task/../../../escaped`. The configured `storage_path` still passes validation because it is inside `GrantedAccessPath`, but the generated backup path escapes that storage directory when `filepath.Join(storage_path, filename)` resolves the embedded traversal sequence. This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent `.key` file, to be written outside the intended storage directory with the Nginx UI process privileges. ## Affected Versions - Current `dev` branch commit checked: `4948fba8744e82c3d7003f68ee164e9f49421066` - Latest release checked: `v2.3.10`, published 2026-04-28 - The vulnerable filename construction is present in both current `dev` and `v2.3.10`. ## Security Boundary The project documentation describes `backup.GrantedAccessPath` as the critical security boundary for backup operations. It says the setting: - restricts backup operations to explicitly authorized directories, - prevents unauthorized access to sensitive system directories, - enforces administrator-defined boundaries, - normalizes paths to prevent traversal attempts. That boundary is enforced for the configured `storage_path`, but not for the final path after the backup name is appended. ## Root Cause `model.AutoBackup.GetName()` only trims whitespace and replaces spaces: ```go func (a *AutoBackup) GetName() string { return strings.ReplaceAll(strings.TrimSpace(a.Name), " ", "_") } ``` The result is then embedded directly into filenames: ```go filename := fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix()) outputPath = filepath.Join(autoBackup.StoragePath, filename) ``` and for custom directory backups: ```go filename := fmt.Sprintf("custom_dir_%s_%d.zip", autoBackup.GetName(), time.Now().Unix()) outputPath = filepath.Join(autoBackup.StoragePath, filename) ``` The API validation rules require `name`, `backup_type`, `storage_type`, `storage_path`, and `cron_expression`, but do not reject `/`, `\`, or `..` in `name`. `ValidateAutoBackupConfig` validates `backup_path` and `storage_path`, but it does not validate the final `outputPath` after appending the generated filename. Relevant paths: - `model/auto_backup.go` - `api/backup/auto_backup.go` - `internal/backup/auto_backup.go` - `internal/backup/utils.go` ## Proof of Concept The following local-only reproducer mirrors the relevant code path without contacting any external system: ```go name := "task/../../../escaped" filename := fmt.Sprintf("custom_dir_%s_%d.zip", getName(name), int64(1715555555)) outputPath := filepath.Join(storageDir, filename) ``` Setup: 1. Create a temporary `granted` directory. 2. Set `sourceDir` and `storageDir` under that granted directory. 3. Treat only `granted` as the allowed path boundary. 4. Use the auto-backup name `task/../../../escaped`. 5. Create the custom-directory backup using the same filename pattern and zip creation behavior. Observed output: ```text granted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted validated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage auto_backup_name="task/../../../escaped" constructed_filename="custom_dir_task/../../../escaped_1715555555.zip" created_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip escaped_validated_storage_path=true created_file_exists=true ``` The configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory. A repo-local regression test was also prepared at: ```text internal/backup/auto_backup_path_traversal_poc_test.go ``` The test cannot currently be executed cleanly in this checkout because unrelated build prerequisites fail before the package test runs: ```text app/app.go: pattern all:dist: no matching files found model/cert.go: no required module provides package github.com/go-acme/lego/v5/certificate internal/helper/key_type.go: no required module provides package github.com/go-acme/lego/v5/certcrypto ``` The standalone reproducer output above was therefore used as the executable proof for this report. ## Impact An authenticated user with access to the auto-backup API can bypass the administrator-configured backup storage boundary. Depending on filesystem permissions and deployment layout, this can: - write backup archives outside the intended `storage_path`, - write encrypted configuration backup key files outside the intended `storage_path`, - place sensitive backup material in directories that administrators did not authorize for backup storage, - create or overwrite timestamp-suffixed files outside the validated backup directory using the Nginx UI process privileges. This is especially relevant because backup archives may contain Nginx UI configuration, database files, Nginx configuration, and for encrypted config backups the adjacent key file required to decrypt the archive. ## Suggested Fix Recommended defense in depth: 1. Treat auto-backup `name` as a display label only, not as a filesystem path component. 2. Sanitize generated filenames with `filepath.Base` or a strict allowlist such as `[A-Za-z0-9._-]`. 3. Reject path separators, drive separators, NUL bytes, and `..` segments in `name`. 4. After constructing `outputPath`, clean it and validate that the final path remains inside the already-validated `storage_path`. 5. Add regression tests for both local and S3 temporary-file paths. Example invariant: ```go cleanOutput := filepath.Clean(outputPath) cleanStorage := filepath.Clean(autoBackup.StoragePath) + string(filepath.Separator) if !strings.HasPrefix(cleanOutput, cleanStorage) { return ErrPathNotInGrantedAccess } ``` ## Disclosure Notes This was tested only in a local isolated environment against source code and temporary directories. No online demo systems or production systems were tested. AI assistance was used to inspect the open-source code, prepare the local reproducer, and draft this report. The issue and PoC output were verified locally before submission.

Source published

15 Oct 2026 20:10:56 UTC

Source modified

19 Oct 2026 21:40:47 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Publisher rating · MODERATE