CVE-2024-49366: falha de alta gravidade em 0xJacky nginx-ui
Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.7epss 0.6%
Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
0xJacky · nginx-uiCVEs relacionadas — 0xJacky nginx-ui
No mesmo produto, das mais perigosas para as menos.
CVE-2026-33032CRITICALNginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx TakeoverEPSS 35.3%CVE-2024-49368HIGHUnchecked logrotate settings lead to arbitrary command executionEPSS 27.7%CVE-2026-27944CRITICALNginx UI: Unauthenticated Backup Download with Encryption Key DisclosureEPSS 22.8%CVE-2024-22198HIGHAuthenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)EPSS 4.1%CVE-2024-22197HIGHAuthenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)EPSS 1.5%CVE-2026-42221HIGHnginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin ClaimEPSS 1.3%