Code Injection Vulnerability in Nginx UI Web Interface by 0xJacky

CVE-2026-84316

What is CVE-2026-84316?

The Nginx UI, a web interface for managing the Nginx web server, contains a vulnerability where configuration directives can be manipulated. Prior to version 2.4.1, the system incorrectly validates configuration by only checking the first token on each line. This flaw enables authenticated users to insert benign directives followed by harmful commands within the same line. Consequently, an attacker can exploit this weakness to bypass validation checks on various write paths, leading to the potential execution of arbitrary code in the context of Nginx's worker processes. The problem has been remediated in the latest version 2.4.1.

References