https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 17 Oct 2026 13:32:10 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-84316 <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.</p> <p>Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-84316 https://db.gcve.eu/vuln/ghsa-cf23-7qxj-xmhr <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>## Summary `config.ValidateConfigFile` is the security control that blocks dangerous nginx directives (`js_*`, `perl_*`, `load_module` of njs/perl modules, `user root`). Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directives with `;`, not newlines. Putting a benign directive first and the blocked directive after a `;` on the SAME line defeats every check. The `include` directive is also not on the denylist. As a result, an authenticated caller can inject the exact directives the hardening was meant to block, through EVERY path that calls the validator — `POST /api/configs` (add), the REST config modify endpoint (api/config/modify.go), the MCP `nginx_config_modify` tool, and the site/stream save paths (internal/site/save.go, internal/stream/save.go). On deployments where nginx has the njs/perl module (the official uozi/nginx-ui Docker image ships ngx_http_js_module.so), this leads to code execution in the nginx worker; with `user root` the workers run as root.</p> <p>This is distinct from the config_add gap (the MCP nginx_config_add tool not calling the validator at all): here the validator IS called and still bypassed, so fixing config_add does not fix this.</p> <p>## Root cause (internal/config/validation.go, ValidateConfigDirectives) ```go for _, line := range bytes.Split(content, []byte(&#34;\n&#34;)) { // splits on \n only trimmed := strings.TrimSpace(string(line)) ... directiv…</p> <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>## Summary `config.ValidateConfigFile` is the security control that blocks dangerous nginx directives (`js_*`, `perl_*`, `load_module` of njs/perl modules, `user root`). Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directives with `;`, not newlines. Putting a benign directive first and the blocked directive after a `;` on the SAME line defeats every check. The `include` directive is also not on the denylist. As a result, an authenticated caller can inject the exact directives the hardening was meant to block, through EVERY path that calls the validator — `POST /api/configs` (add), the REST config modify endpoint (api/config/modify.go), the MCP `nginx_config_modify` tool, and the site/stream save paths (internal/site/save.go, internal/stream/save.go). On deployments where nginx has the njs/perl module (the official uozi/nginx-ui Docker image ships ngx_http_js_module.so), this leads to code execution in the nginx worker; with `user root` the workers run as root.</p> <p>This is distinct from the config_add gap (the MCP nginx_config_add tool not calling the validator at all): here the validator IS called and still bypassed, so fixing config_add does not fix this.</p> <p>## Root cause (internal/config/validation.go, ValidateConfigDirectives) ```go for _, line := range bytes.Split(content, []byte(&#34;\n&#34;)) { // splits on \n only trimmed := strings.TrimSpace(string(line)) ... directiv…</p> https://db.gcve.eu/vuln/ghsa-cf23-7qxj-xmhr