CVE-2024-22197

Nginx-ui is online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. The `Home > Preference` page exposes a small list of nginx settings such as `Nginx Access Log Path` and `Nginx Error Log Path`. However, the API also exposes `test_config_cmd`, `reload_cmd` and `restart_cmd`. While the UI doesn't allow users to modify any of these settings, it is possible to do so by sending a request to the API. This issue may lead to authenticated Remote Code Execution, Privilege Escalation, and Information Disclosure. This issue has been patched in version 2.0.0.beta.9.

• CWE-77

• https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3Patch
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9mExploit, Vendor Advisory
• https://github.com/0xJacky/nginx-ui/commit/827e76c46e63c52114a62a899f61313039c754e3Patch
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9mExploit, Vendor Advisory

Published

Jan 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22191Avo is a framework to create admin panels for Ruby on Rails …5.4
• CVE-2024-22192Ursa is a cryptographic library for use with blockchains. Th…6.5
• CVE-2024-22193The vantage6 technology enables to manage and deploy privacy…4.3
• CVE-2024-22194cdo-local-uuid project provides a specialized UUID-generatin…2.8
• CVE-2024-22195Jinja is an extensible templating engine. Special placeholde…6.1
• CVE-2024-22196Nginx-UI is an online statistics for Server Indicators​​ Mon…6.5
• CVE-2024-22198Nginx-UI is a web interface to manage Nginx configurations. …8.8
• CVE-2024-22199This package provides universal methods to use multiple temp…6.1
• CVE-2024-2220The Button contact VR WordPress plugin through 4.7 does not …3.5
• CVE-2024-22200vantage6-UI is the User Interface for vantage6. The docker i…5.3
• CVE-2024-22201Jetty is a Java based web server and servlet engine. An HTTP…7.5
• CVE-2024-22202phpMyFAQ is an open source FAQ web application for PHP 8.1+ …6.5