Vulnerability-Lookup

GHSA-JRQ7-XRJX-PCFW

Vulnerability from github – Published: 2026-10-15 20:10 – Updated: 2026-10-15 20:10

Summary

Nginx UI: Auto backup name allows path traversal outside validated storage path

Details

Summary

Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components.

An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_path still passes validation because it is inside GrantedAccessPath, but the generated backup path escapes that storage directory when filepath.Join(storage_path, filename) resolves the embedded traversal sequence.

This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent .key file, to be written outside the intended storage directory with the Nginx UI process privileges.

Affected Versions

Current dev branch commit checked: 4948fba8744e82c3d7003f68ee164e9f49421066
Latest release checked: v2.3.10, published 2026-04-28
The vulnerable filename construction is present in both current dev and v2.3.10.

Security Boundary

The project documentation describes backup.GrantedAccessPath as the critical security boundary for backup operations. It says the setting:

restricts backup operations to explicitly authorized directories,
prevents unauthorized access to sensitive system directories,
enforces administrator-defined boundaries,
normalizes paths to prevent traversal attempts.

That boundary is enforced for the configured storage_path, but not for the final path after the backup name is appended.

Root Cause

model.AutoBackup.GetName() only trims whitespace and replaces spaces:

func (a *AutoBackup) GetName() string {
    return strings.ReplaceAll(strings.TrimSpace(a.Name), " ", "_")
}

The result is then embedded directly into filenames:

filename := fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)

and for custom directory backups:

filename := fmt.Sprintf("custom_dir_%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)

The API validation rules require name, backup_type, storage_type, storage_path, and cron_expression, but do not reject /, \, or .. in name. ValidateAutoBackupConfig validates backup_path and storage_path, but it does not validate the final outputPath after appending the generated filename.

Relevant paths:

model/auto_backup.go
api/backup/auto_backup.go
internal/backup/auto_backup.go
internal/backup/utils.go

Proof of Concept

The following local-only reproducer mirrors the relevant code path without contacting any external system:

name := "task/../../../escaped"
filename := fmt.Sprintf("custom_dir_%s_%d.zip", getName(name), int64(1715555555))
outputPath := filepath.Join(storageDir, filename)

Setup:

Create a temporary granted directory.
Set sourceDir and storageDir under that granted directory.
Treat only granted as the allowed path boundary.
Use the auto-backup name task/../../../escaped.
Create the custom-directory backup using the same filename pattern and zip creation behavior.

Observed output:

granted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted
validated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage
auto_backup_name="task/../../../escaped"
constructed_filename="custom_dir_task/../../../escaped_1715555555.zip"
created_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip
escaped_validated_storage_path=true
created_file_exists=true

The configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory.

A repo-local regression test was also prepared at:

internal/backup/auto_backup_path_traversal_poc_test.go

The test cannot currently be executed cleanly in this checkout because unrelated build prerequisites fail before the package test runs:

app/app.go: pattern all:dist: no matching files found
model/cert.go: no required module provides package github.com/go-acme/lego/v5/certificate
internal/helper/key_type.go: no required module provides package github.com/go-acme/lego/v5/certcrypto

The standalone reproducer output above was therefore used as the executable proof for this report.

Impact

An authenticated user with access to the auto-backup API can bypass the administrator-configured backup storage boundary. Depending on filesystem permissions and deployment layout, this can:

write backup archives outside the intended storage_path,
write encrypted configuration backup key files outside the intended storage_path,
place sensitive backup material in directories that administrators did not authorize for backup storage,
create or overwrite timestamp-suffixed files outside the validated backup directory using the Nginx UI process privileges.

This is especially relevant because backup archives may contain Nginx UI configuration, database files, Nginx configuration, and for encrypted config backups the adjacent key file required to decrypt the archive.

Suggested Fix

Recommended defense in depth:

Treat auto-backup name as a display label only, not as a filesystem path component.
Sanitize generated filenames with filepath.Base or a strict allowlist such as [A-Za-z0-9._-].
Reject path separators, drive separators, NUL bytes, and .. segments in name.
After constructing outputPath, clean it and validate that the final path remains inside the already-validated storage_path.
Add regression tests for both local and S3 temporary-file paths.

Example invariant:

cleanOutput := filepath.Clean(outputPath)
cleanStorage := filepath.Clean(autoBackup.StoragePath) + string(filepath.Separator)
if !strings.HasPrefix(cleanOutput, cleanStorage) {
    return ErrPathNotInGrantedAccess
}

Disclosure Notes

This was tested only in a local isolated environment against source code and temporary directories. No online demo systems or production systems were tested.

AI assistance was used to inspect the open-source code, prepare the local reproducer, and draft this report. The issue and PoC output were verified locally before submission.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.9.10-0.20260715121709-f92218e01054"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-84320"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-15T20:10:56Z",
    "nvd_published_at": "2026-10-12T21:17:22Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nNginx UI validates `backup_path` and `storage_path` against the administrator-defined `backup.GrantedAccessPath` boundary, but the final auto-backup output filename is built from the user-controlled auto-backup `name` without stripping path separators or `..` components.\n\nAn authenticated user who can create or modify an auto-backup task can set a name such as `task/../../../escaped`. The configured `storage_path` still passes validation because it is inside `GrantedAccessPath`, but the generated backup path escapes that storage directory when `filepath.Join(storage_path, filename)` resolves the embedded traversal sequence.\n\nThis bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent `.key` file, to be written outside the intended storage directory with the Nginx UI process privileges.\n\n## Affected Versions\n\n- Current `dev` branch commit checked: `4948fba8744e82c3d7003f68ee164e9f49421066`\n- Latest release checked: `v2.3.10`, published 2026-04-28\n- The vulnerable filename construction is present in both current `dev` and `v2.3.10`.\n\n## Security Boundary\n\nThe project documentation describes `backup.GrantedAccessPath` as the critical security boundary for backup operations. It says the setting:\n\n- restricts backup operations to explicitly authorized directories,\n- prevents unauthorized access to sensitive system directories,\n- enforces administrator-defined boundaries,\n- normalizes paths to prevent traversal attempts.\n\nThat boundary is enforced for the configured `storage_path`, but not for the final path after the backup name is appended.\n\n## Root Cause\n\n`model.AutoBackup.GetName()` only trims whitespace and replaces spaces:\n\n```go\nfunc (a *AutoBackup) GetName() string {\n    return strings.ReplaceAll(strings.TrimSpace(a.Name), \" \", \"_\")\n}\n```\n\nThe result is then embedded directly into filenames:\n\n```go\nfilename := fmt.Sprintf(\"%s_%d.zip\", autoBackup.GetName(), time.Now().Unix())\noutputPath = filepath.Join(autoBackup.StoragePath, filename)\n```\n\nand for custom directory backups:\n\n```go\nfilename := fmt.Sprintf(\"custom_dir_%s_%d.zip\", autoBackup.GetName(), time.Now().Unix())\noutputPath = filepath.Join(autoBackup.StoragePath, filename)\n```\n\nThe API validation rules require `name`, `backup_type`, `storage_type`, `storage_path`, and `cron_expression`, but do not reject `/`, `\\`, or `..` in `name`. `ValidateAutoBackupConfig` validates `backup_path` and `storage_path`, but it does not validate the final `outputPath` after appending the generated filename.\n\nRelevant paths:\n\n- `model/auto_backup.go`\n- `api/backup/auto_backup.go`\n- `internal/backup/auto_backup.go`\n- `internal/backup/utils.go`\n\n## Proof of Concept\n\nThe following local-only reproducer mirrors the relevant code path without contacting any external system:\n\n```go\nname := \"task/../../../escaped\"\nfilename := fmt.Sprintf(\"custom_dir_%s_%d.zip\", getName(name), int64(1715555555))\noutputPath := filepath.Join(storageDir, filename)\n```\n\nSetup:\n\n1. Create a temporary `granted` directory.\n2. Set `sourceDir` and `storageDir` under that granted directory.\n3. Treat only `granted` as the allowed path boundary.\n4. Use the auto-backup name `task/../../../escaped`.\n5. Create the custom-directory backup using the same filename pattern and zip creation behavior.\n\nObserved output:\n\n```text\ngranted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted\nvalidated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage\nauto_backup_name=\"task/../../../escaped\"\nconstructed_filename=\"custom_dir_task/../../../escaped_1715555555.zip\"\ncreated_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip\nescaped_validated_storage_path=true\ncreated_file_exists=true\n```\n\nThe configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory.\n\nA repo-local regression test was also prepared at:\n\n```text\ninternal/backup/auto_backup_path_traversal_poc_test.go\n```\n\nThe test cannot currently be executed cleanly in this checkout because unrelated build prerequisites fail before the package test runs:\n\n```text\napp/app.go: pattern all:dist: no matching files found\nmodel/cert.go: no required module provides package github.com/go-acme/lego/v5/certificate\ninternal/helper/key_type.go: no required module provides package github.com/go-acme/lego/v5/certcrypto\n```\n\nThe standalone reproducer output above was therefore used as the executable proof for this report.\n\n## Impact\n\nAn authenticated user with access to the auto-backup API can bypass the administrator-configured backup storage boundary. Depending on filesystem permissions and deployment layout, this can:\n\n- write backup archives outside the intended `storage_path`,\n- write encrypted configuration backup key files outside the intended `storage_path`,\n- place sensitive backup material in directories that administrators did not authorize for backup storage,\n- create or overwrite timestamp-suffixed files outside the validated backup directory using the Nginx UI process privileges.\n\nThis is especially relevant because backup archives may contain Nginx UI configuration, database files, Nginx configuration, and for encrypted config backups the adjacent key file required to decrypt the archive.\n\n## Suggested Fix\n\nRecommended defense in depth:\n\n1. Treat auto-backup `name` as a display label only, not as a filesystem path component.\n2. Sanitize generated filenames with `filepath.Base` or a strict allowlist such as `[A-Za-z0-9._-]`.\n3. Reject path separators, drive separators, NUL bytes, and `..` segments in `name`.\n4. After constructing `outputPath`, clean it and validate that the final path remains inside the already-validated `storage_path`.\n5. Add regression tests for both local and S3 temporary-file paths.\n\nExample invariant:\n\n```go\ncleanOutput := filepath.Clean(outputPath)\ncleanStorage := filepath.Clean(autoBackup.StoragePath) + string(filepath.Separator)\nif !strings.HasPrefix(cleanOutput, cleanStorage) {\n    return ErrPathNotInGrantedAccess\n}\n```\n\n## Disclosure Notes\n\nThis was tested only in a local isolated environment against source code and temporary directories. No online demo systems or production systems were tested.\n\nAI assistance was used to inspect the open-source code, prepare the local reproducer, and draft this report. The issue and PoC output were verified locally before submission.",
  "id": "GHSA-jrq7-xrjx-pcfw",
  "modified": "2026-10-15T20:10:56Z",
  "published": "2026-10-15T20:10:56Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84320"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Nginx UI: Auto backup name allows path traversal outside validated storage path"
}

CVE-2026-84320 (GCVE-0-2026-84320)

Vulnerability from cvelistv5 – Published: 2026-10-12 20:44 – Updated: 2026-10-13 20:24

Title

Nginx UI: Auto backup name allows path traversal outside validated storage path

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-13 20:13 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7926 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/0xJacky/nginx-ui/security/advi…	x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/commit/f92218…	x_refsource_MISC
https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
0xJacky	nginx-ui	Affected: < 2.4.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84320",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-13T20:13:20.768872Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-13T20:24:05.329Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup\u0027s storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-12T20:44:39.471Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"
        }
      ],
      "source": {
        "advisory": "GHSA-jrq7-xrjx-pcfw",
        "discovery": "UNKNOWN"
      },
      "title": "Nginx UI: Auto backup name allows path traversal outside validated storage path"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-84320",
    "datePublished": "2026-10-12T20:44:39.471Z",
    "dateReserved": "2026-09-01T16:17:43.080Z",
    "dateUpdated": "2026-10-13T20:24:05.329Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-JRQ7-XRJX-PCFW

Summary

Affected Versions

Security Boundary

Root Cause

Proof of Concept

Impact

Suggested Fix

Disclosure Notes

CVE-2026-84320 (GCVE-0-2026-84320)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour