Nginx UI CVE-2026-84320

Requires an authenticated Nginx UI account with permission to create or modify an automatic backup configuration; the attacker sets the backup's Name field to include path separators or parent-directory ('..') components, which AutoBackup.GetName passes through unsanitized into the archive filename. Exploitation only triggers when that automatic backup actually executes, and for the encryption-key write it additionally requires the backup to be configured as an encrypted configuration backup. Limiting factors: authentication and backup-management privileges are mandatory (PR:L), the write is confined to the generated archive/key filename (not arbitrary content into arbitrary files), and impact scales with the privileges of the Nginx UI process. Versions 2.4.3 and later reject separators, '..', Windows reserved characters/device names, and sanitize the name, removing the condition.

This is a medium-severity, authenticated path traversal (CWE-22) with a vendor/NVD CVSS 3.1 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L (6.3). The PR:L metric confirms exploitation requires an authenticated account - specifically one with permission to create or modify an automatic backup - so this is not an unauthenticated internet-facing bug. No EPSS score, SSVC decision, KEV listing, or public POC was provided in the intelligence set; exploitation status is therefore 'no public exploit identified at time of analysis.' The signals are internally consistent (network-reachable admin UI, low complexity, low privileges, no user interaction), but the real-world impact is constrained: the primitive is an arbitrary-location file WRITE of a backup archive (and, for encrypted backups, the adjacent key file) with the Nginx UI process privileges - not a read or direct code-execution primitive. The official vector rates confidentiality as Low, which is debatable since the flaw writes rather than reads files; I independently assess confidentiality impact as negligible (see assessed vectors). Net: a genuine but bounded privilege/integrity issue requiring an existing authenticated foothold, best prioritized where Nginx UI is multi-tenant or exposed, not treated as a critical widespread threat.

An authenticated Nginx UI user with access to backup configuration creates or edits an automatic backup whose Name contains path separators and parent-directory components (e.g. '..\evil/...'); because AutoBackup.GetName returns the unsanitized name and it is embedded into the archive filename, filepath.Join resolves the output outside the validated storage directory. When the scheduled backup runs, the archive - and for encrypted configuration backups the encryption key file - is written to an attacker-chosen location with the Nginx UI process's privileges, potentially overwriting sensitive files. No public exploit was identified at time of analysis; exploitation requires only low privileges, no user interaction, and low attack complexity (AV:N/AC:L).