CVE-2026-84320: Nginx UI Path Traversal Vulnerability

CVE-2026-84320 Overview

CVE-2026-84320 is a path traversal vulnerability [CWE-22] in Nginx UI, a web user interface for the Nginx web server. The flaw affects versions prior to 2.4.3. Nginx UI validates the storage_path for automatic backups, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components. Downstream filename formatting embeds that value into the final archive filename, allowing filepath.Join to resolve archive paths outside the validated storage directory. An authenticated user with permission to create or modify an automatic backup can write backup archives, and adjacent encryption key files for encrypted configuration backups, with Nginx UI process privileges.

Critical Impact
Authenticated attackers can write backup archives and encryption keys to arbitrary filesystem locations with the Nginx UI process privileges.

Affected Products

Nginx UI versions prior to 2.4.3
Deployments exposing automatic backup configuration to authenticated users
Instances performing encrypted configuration backups with adjacent key file writes

Discovery Timeline

2026-10-12 - CVE-2026-84320 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-84320

Vulnerability Analysis

The vulnerability resides in the automatic backup subsystem of Nginx UI. While the storage_path field is validated, the backup filename returned by AutoBackup.GetName is treated as trusted. The filename flows into a formatting routine that constructs the archive path through filepath.Join. When the name contains path separators or .. parent-directory sequences, filepath.Join normalizes the result and resolves it outside the validated storage directory.

Because the Nginx UI process writes the archive, any file in a location writable by that process can be overwritten or created. For encrypted configuration backups, the adjacent encryption key file inherits the same tainted path logic, so sensitive key material can also be placed outside the intended directory.

Root Cause

The root cause is incomplete input validation of the automatic backup filename field. Validation covered storage_path and Windows UNC prefixes but did not reject path separators, parent-directory components, Windows reserved characters, or Windows reserved filenames before the value was used in path construction.

Attack Vector

An authenticated user with access to create or modify an automatic backup supplies a crafted filename containing path separators or .. segments. When the backup job runs, Nginx UI formats the final archive path and filepath.Join resolves it outside the validated storage directory. The archive, and any adjacent encryption key file, is written with the privileges of the Nginx UI process.

// Security patch in internal/backup/auto_backup.go — hardened filename validation
if strings.HasPrefix(filename, `\\`) {
    return cosy.WrapErrorWithParams(ErrAutoBackupInvalidFilename, "filename contains Windows UNC prefix")
}
if strings.ContainsAny(filename, `<>:"|?*`) {
    return cosy.WrapErrorWithParams(ErrAutoBackupInvalidFilename, "filename contains Windows reserved characters")
}
if isWindowsReservedFilename(filename) {
    return cosy.WrapErrorWithParams(ErrAutoBackupInvalidFilename, "filename uses a Windows reserved name")
}
if strings.ContainsAny(filename, `/\`) {
    return cosy.WrapErrorWithParams(ErrAutoBackupInvalidFilename, "filename must not contain path separators")
}
// Source: https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb

Detection Methods for CVE-2026-84320

Indicators of Compromise

Backup archive files appearing outside the configured storage_path directory
Automatic backup configurations containing filenames with /, \, or .. sequences
Unexpected .key or encryption key files written to system or application directories by the Nginx UI process
Audit log entries showing creation or modification of automatic backup entries by non-administrative users

Detection Strategies

Review the Nginx UI database for auto_backup records with filenames that contain path separators, parent-directory components, or Windows reserved names.
Inspect filesystem writes by the Nginx UI service process to directories outside the configured backup storage location.
Compare installed Nginx UI version against 2.4.3 across all managed hosts.

Monitoring Recommendations

Enable file integrity monitoring on directories writable by the Nginx UI process user.
Forward Nginx UI application logs and host audit logs to a central analytics platform and alert on backup job errors or path anomalies.
Track authenticated API calls to the automatic backup configuration endpoints and alert on unexpected modifications.

How to Mitigate CVE-2026-84320

Immediate Actions Required

Upgrade Nginx UI to version 2.4.3 or later on all deployments.
Audit all existing automatic backup entries and remove any with suspicious filename values.
Restrict access to Nginx UI administrative endpoints to trusted operators only.
Rotate any encryption keys used by configuration backups if tampering is suspected.

Patch Information

The fix is included in Nginx UI v2.4.3. The hardening commit f92218e adds filename validation that rejects path separators, Windows reserved characters, Windows reserved names, and UNC prefixes. Technical details are available in the GHSA-jrq7-xrjx-pcfw advisory and the upstream commit.

Workarounds

Disable automatic backups until the 2.4.3 upgrade is applied.
Run the Nginx UI process under a dedicated low-privilege user with filesystem access limited to the backup storage directory.
Place the Nginx UI storage directory on a mount or container volume that isolates it from system paths.

bash

# Example: run Nginx UI as a restricted service user with a scoped storage path
sudo useradd --system --home /var/lib/nginx-ui --shell /usr/sbin/nologin nginxui
sudo install -d -o nginxui -g nginxui -m 0750 /var/lib/nginx-ui/backups
# Confirm upgrade
nginx-ui --version   # expect 2.4.3 or later