CVE-2024-49367

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, the log path of nginxui is controllable. This issue can be combined with the directory traversal at `/api/configs` to read directories and file contents on the server. Version 2.0.0-beta.36 fixes the issue.

• CWE-862

• https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36Release Notes
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-gr34-jgw4-7j4mVendor Advisory

Published

Oct 21, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-49361ACON is a widely-used library of tools for machine learning …8.1
• CVE-2024-49362Joplin is a free, open source note taking and to-do applicat…9.6
• CVE-2024-49363Misskey is an open source, federated social media platform. …7.4
• CVE-2024-49364tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior …8.1
• CVE-2024-49365tiny-secp256k1 is a tiny secp256k1 native/JS wrapper. Prior …8.1
• CVE-2024-49366Nginx UI is a web user interface for the Nginx web server. N…7.5
• CVE-2024-49368Nginx UI is a web user interface for the Nginx web server. P…9.8
• CVE-2024-49369Icinga is a monitoring system which checks the availability …9.8
• CVE-2024-49370Pimcore is an open source data and experience management pla…4.9
• CVE-2024-49373No Fuss Computing Centurion ERP is open source enterprise re…4.3
• CVE-2024-49375Open source machine learning framework. A vulnerability has …9
• CVE-2024-49376Autolab, a course management service that enables auto-grade…8.8