Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2024-49366: Nginx UI allows file write via crafted JSON
CVE-2024-49366 · published 2 years ago
Summary
The Nginx UI web interface (versions up to 2.0.0-beta.35) accepts a JSON field without checking its contents, letting an attacker include "../.." sequences that cause files to be written anywhere on the server. This could let someone add or change files and potentially gain higher privileges. Update to version 2.0.0-beta.26 or later, and verify that any custom JSON inputs are properly validated.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| nginxui | nginx_ui |
<= 1.9.9-4 2.0.0 cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* |
Original advisory text
Nginx UI's json field can construct a directory traversal payload, causing arbitrary files to be written
Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.
References
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36 URL
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-prv4-rx44-f7jr Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/49xxx/CVE-2024-49366... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-49366 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Severity
8.3
High
Type
CWE-22Path Traversal
Timeline
Published21 Oct 2024
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta