EUVD-2026-77071
GHSA-8mrj-3xx2-r42f
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Arbitrary JAR download and execution crosses application boundary to OS-level RCE (S:C/C:H/I:H/A:H), requiring only an authenticated session (PR:L) over the network.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
AnalysisAI
Remote code execution in cym1102 nginxWebUI up to 4.4.2 is achievable by any authenticated user via the autoUpdate endpoint, which accepts an arbitrary url parameter and downloads and executes the resulting JAR file on the host OS without domain validation. A public proof-of-concept is disclosed in GitHub issue #213, and a fix exists only as an unmerged PR (#215) - no released patched version has been confirmed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session on the nginxWebUI admin panel (PR:L - any logged-in account that can reach the `/adminPage/` namespace). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector correctly identifies network access and low-privilege authentication (AV:N/PR:L) but assigns anomalously low impact (VC:L/VI:L/VA:L) that does not reflect the actual OS-level code execution capability of arbitrary JAR execution. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No released patched version has been independently confirmed - the fix is available as unmerged PR #215 at https://github.com/cym1102/nginxWebUI/pull/215, which operators building from source can apply manually. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Nginxwebui
View allA vulnerability, which was classified as critical, has been found in cym1102 nginxWebUI up to 3.9.9. Rated critical seve
A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. Rated critical severity (CVSS 9.8),
A vulnerability classified as critical has been found in cym1102 nginxWebUI up to 3.9.9. Rated critical severity (CVSS 9
A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. Rated critical severity (CVSS 9.8), this vulnerability is r
A vulnerability was found in cym1102 nginxWebUI up to 3.9.9. Rated high severity (CVSS 7.5), this vulnerability is remot
A vulnerability was identified in cym1102 nginxWebUI up to 4.3.7. The impacted element is an unknown function of the fil
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today