https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 19:43:19 +0000 https://db.gcve.eu/vuln/cve-2026-84318 <p><strong>Affected:</strong> 0xJacky nginx-ui</p> <p>Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui&#39;s entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.</p> <p><strong>Affected:</strong> 0xJacky nginx-ui</p> <p>Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API (POST /api/configs) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (perl, js_import, load_module, user root, etc.), bypassing nginx-ui&#39;s entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution. This issue is fixed in version 2.4.1.</p> https://db.gcve.eu/vuln/cve-2026-84318 https://db.gcve.eu/vuln/ghsa-9jww-cxg5-rj9m <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>### Summary</p> <p>The MCP tool `nginx_config_add` writes nginx configuration files to disk and triggers an nginx reload without calling `config.ValidateConfigFile`. The identical flow in the REST API (`POST /api/configs`) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (`perl`, `js_import`, `load_module`, `user root`, etc.), bypassing nginx-ui&#39;s entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution.</p> <p>### Details</p> <p>`api/config/add.go` (line 46) calls `config.ValidateConfigFile` before writing:</p> <p>```go err = config.ValidateConfigFile(path, content) // validates directives, checks blocklist if err != nil { cosy.ErrHandler(c, err) return } ```</p> <p>`mcp/config/config_add.go` (line 79) omits that call entirely and writes directly:</p> <p>```go err = os.WriteFile(path, []byte(content), 0644) // no ValidateConfigFile, no blocklist check ... res := nginx.Control(nginx.Reload) // reload triggered immediately ```</p> <p>`config.ValidateConfigFile` runs two checks: - **`ValidateConfigContent`** — rejects control characters, enforces encoding. - **`ValidateConfigDirectives`** — rejects a blocklist of dangerous directives: `perl`, `perl_modules`, `perl_require`, `perl_set`, `js_import`, `js_set`, `js_content`, `load_module` (restricted modules), `user root`, and others.</p> <p>Neither check runs…</p> <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>### Summary</p> <p>The MCP tool `nginx_config_add` writes nginx configuration files to disk and triggers an nginx reload without calling `config.ValidateConfigFile`. The identical flow in the REST API (`POST /api/configs`) does call that function and correctly rejects dangerous directives. An authenticated attacker can exploit this gap to write config files containing any blocked directive (`perl`, `js_import`, `load_module`, `user root`, etc.), bypassing nginx-ui&#39;s entire security layer. On a server with the nginx Perl, njs, or Lua module loaded, this is post-authentication Remote Code Execution.</p> <p>### Details</p> <p>`api/config/add.go` (line 46) calls `config.ValidateConfigFile` before writing:</p> <p>```go err = config.ValidateConfigFile(path, content) // validates directives, checks blocklist if err != nil { cosy.ErrHandler(c, err) return } ```</p> <p>`mcp/config/config_add.go` (line 79) omits that call entirely and writes directly:</p> <p>```go err = os.WriteFile(path, []byte(content), 0644) // no ValidateConfigFile, no blocklist check ... res := nginx.Control(nginx.Reload) // reload triggered immediately ```</p> <p>`config.ValidateConfigFile` runs two checks: - **`ValidateConfigContent`** — rejects control characters, enforces encoding. - **`ValidateConfigDirectives`** — rejects a blocklist of dangerous directives: `perl`, `perl_modules`, `perl_require`, `perl_set`, `js_import`, `js_set`, `js_content`, `load_module` (restricted modules), `user root`, and others.</p> <p>Neither check runs…</p> https://db.gcve.eu/vuln/ghsa-9jww-cxg5-rj9m