Answer in brief
CVE-2026-84320 records a Medium severity (CVSS 6.3) vulnerability in Nginx UI: Auto backup name allows path traversal outside validated storage path. The current sources do not mark it as known exploited. The current feed maps 0xJacky/nginx-ui (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps 0xJacky/nginx-ui (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| 0xJacky/nginx-uigeneric | <2.4.3 | 2.4.3 |
Published upstream
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 12, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 12, 2026
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.
Quoted source text, attributed separately from HOL analysis.