CVE-2026-84320: 
Nginx UI vulnerability analysis and mitigation

CVE-2026-84320 is a path traversal vulnerability in Nginx UI, a web-based management interface for the Nginx web server. The flaw allows authenticated users to write backup archives outside the administrator-configured storage directory by embedding path traversal sequences (e.g., ../) in an auto-backup task name. All versions prior to 2.4.3 (including the latest release v2.3.10 at time of disclosure) are affected. It carries a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, Feedly).

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerable function model.AutoBackup.GetName() only trims whitespace and replaces spaces with underscores, without stripping path separators (/, \) or parent-directory components (..). The sanitized name is then embedded directly into the archive filename via fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix()), and the final path is constructed with filepath.Join(autoBackup.StoragePath, filename). Because filepath.Join resolves embedded traversal sequences, the resulting path can escape the validated storage_path boundary enforced by GrantedAccessPath. For encrypted configuration backups, the adjacent .key file is also written to the traversed location. The API validation checks backup_path and storage_path but does not re-validate the final outputPath after appending the user-controlled filename component (GitHub Advisory, Fix Commit).

An authenticated attacker with access to the auto-backup API can write backup archives — which may contain Nginx UI configuration, database files, and Nginx configuration — to arbitrary filesystem locations accessible to the Nginx UI process. For encrypted configuration backups, the associated decryption key file can also be placed outside the intended directory. This could allow an attacker to overwrite sensitive files, stage data in attacker-accessible directories, or expose backup material (including credentials) in unintended locations, depending on filesystem permissions and deployment layout (GitHub Advisory).

No public exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires authenticated access with privileges to create or modify auto-backup tasks, limiting the attack surface to trusted but potentially malicious insiders or compromised accounts (Feedly, GitHub Advisory).

1. Authenticate: Log in to the Nginx UI instance with an account that has permission to create or modify automatic backup tasks.
2. Create or edit an auto-backup task: Navigate to the auto-backup configuration in the Nginx UI web interface.
3. Inject traversal sequence in the backup name: Set the backup task name field to a value containing path traversal components, e.g., task/../../../escaped.
4. Configure a valid storage path: Set storage_path to a legitimate directory within GrantedAccessPath so that the path validation check passes.
5. Trigger the backup: Save the task and allow it to execute (either by waiting for the cron schedule or triggering it manually).
6. Observe file written outside storage directory: The generated filename (e.g., custom_dir_task/../../../escaped_<timestamp>.zip) is passed to filepath.Join(storage_path, filename), which resolves the traversal and writes the archive outside the validated directory with Nginx UI process privileges. For encrypted backups, the .key file is also written to the traversed path (GitHub Advisory).

• File System: Unexpected .zip archive files with timestamp-suffixed names (e.g., escaped_<unix_timestamp>.zip) appearing outside the configured Nginx UI backup storage directory; .key files appearing in unexpected filesystem locations outside the backup storage path.
• Logs: Nginx UI application logs showing auto-backup task creation or modification with names containing /, \, or .. sequences; file write operations to paths outside the configured storage_path or GrantedAccessPath.
• Application: Auto-backup tasks with names containing path separator characters or parent-directory references (../, .\) visible in the Nginx UI backup task list.

Upgrade Nginx UI to version 2.4.3 or later, which hardens AutoBackup.GetName() via a new SafeAutoBackupName() function that strips path separators, .. components, and other unsafe characters, replacing them with underscores. The fix also adds a post-construction path validation step to ensure the final output path remains inside the validated storage directory. No configuration-based workaround is available for unpatched versions; restricting auto-backup task creation to highly trusted accounts can reduce risk until patching is possible (GitHub Release v2.4.3, Fix Commit).