CVE-2026-33027

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.

• CWE-22
• CWE-73

• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4Product, Release Notes
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357Exploit, Vendor Advisory
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-m8p8-53vf-8357Exploit, Vendor Advisory

Published

Mar 30, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33021libsixel is a SIXEL encoder/decoder implementation derived f…7.3
• CVE-2026-33022Tekton Pipelines project provides k8s-style resources for de…6.5
• CVE-2026-33023libsixel is a SIXEL encoder/decoder implementation derived f…7.8
• CVE-2026-33024AVideo is a video-sharing Platform. Versions prior to 8.0 co…9.1
• CVE-2026-33025AVideo is a video-sharing Platform. Versions prior to 8.0 co…8.8
• CVE-2026-33026Nginx UI is a web user interface for the Nginx web server. P…9.1
• CVE-2026-33028Nginx UI is a web user interface for the Nginx web server. P…7.5
• CVE-2026-33029Nginx UI is a web user interface for the Nginx web server. P…6.5
• CVE-2026-33030Nginx UI is a web user interface for the Nginx web server. I…9.9
• CVE-2026-33031Nginx UI is a web user interface for the Nginx web server. P…8.1
• CVE-2026-33032Nginx UI is a web user interface for the Nginx web server. I…9.8
• CVE-2026-33033An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.…6.5