CVE-2026-33026

EUVD-2026-17194
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.1 CRITICAL
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 5%
Affected Products (NVD)
VendorProductVersion
nginxuinginx_ui
𝑥
< 2.3.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq