Security Vulnerability in Nginx UI Affects Nginx Web Server by 0xJacky

CVE-2026-84317

What is CVE-2026-84317?

Nginx UI, the web user interface for the Nginx web server, has identified a vulnerability related to improper control of configuration files prior to version 2.4.1. The 'ValidateConfigFile' function was designed to block certain dangerous Nginx directives, such as js_, perl_, and the loading of NJS/perl modules. However, this control was not invoked on one of the critical configuration write paths, allowing an authenticated MCP caller to potentially write harmful directives directly to disk. This flaw enables attackers to exploit Nginx deployments that support the NJS/perl module, leading to code execution. Users are advised to upgrade to version 2.4.1 or above to mitigate this risk.

References