CVE-2026-84320

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

Summary

Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components.

An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_path still passes validation because it is inside GrantedAccessPath, but the generated backup path escapes that storage directory when filepath.Join(storage_path, filename) resolves the embedded traversal sequence.

This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent .key file, to be written outside the intended storage directory with the Nginx UI process privileges.

Affected Versions

• Current dev branch commit checked: 4948fba8744e82c3d7003f68ee164e9f49421066
• Latest release checked: v2.3.10, published 2026-04-28
• The vulnerable filename construction is present in both current dev and v2.3.10.

Security Boundary

The project documentation describes backup.GrantedAccessPath as the critical security boundary for backup operations. It says the setting:

• restricts backup operations to explicitly authorized directories,
• prevents unauthorized access to sensitive system directories,
• enforces administrator-defined boundaries,
• normalizes paths to prevent traversal attempts.

That boundary is enforced for the configured storage_path, but not for the final path after the backup name is appended.

Root Cause

model.AutoBackup.GetName() only trims whitespace and replaces spaces:

func (a *AutoBackup) GetName() string {
    return strings.ReplaceAll(strings.TrimSpace(a.Name), " ", "_")
}

The result is then embedded directly into filenames:

filename := fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)

and for custom directory backups:

filename := fmt.Sprintf("custom_dir_%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)

The API validation rules require name, backup_type, storage_type, storage_path, and cron_expression, but do not reject /, \, or .. in name. ValidateAutoBackupConfig validates backup_path and storage_path, but it does not validate the final outputPath after appending the generated filename.

Relevant paths:

• model/auto_backup.go
• api/backup/auto_backup.go
• internal/backup/auto_backup.go
• internal/backup/utils.go

Proof of Concept

The following local-only reproducer mirrors the relevant code path without contacting any external system:

name := "task/../../../escaped"
filename := fmt.Sprintf("custom_dir_%s_%d.zip", getName(name), int64(1715555555))
outputPath := filepath.Join(storageDir, filename)

Setup:

1. Create a temporary granted directory.
2. Set sourceDir and storageDir under that granted directory.
3. Treat only granted as the allowed path boundary.
4. Use the auto-backup name task/../../../escaped.
5. Create the custom-directory backup using the same filename pattern and zip creation behavior.

Observed output:

granted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted
validated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage
auto_backup_name="task/../../../escaped"
constructed_filename="custom_dir_task/../../../escaped_1715555555.zip"
created_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip
escaped_validated_storage_path=true
created_file_exists=true

The configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory.

A…

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that result in the final archive filename. An authenticated user who can create or modify an automatic backup can cause filepath.Join to resolve the generated archive path outside the validated storage directory, allowing backup archives to be written with the Nginx UI process privileges. For encrypted configuration backups, the adjacent encryption key file can also be written outside the validated directory. This issue is fixed in version 2.4.3.

Summary

Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components.

An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_path still passes validation because it is inside GrantedAccessPath, but the generated backup path escapes that storage directory when filepath.Join(storage_path, filename) resolves the embedded traversal sequence.

This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent .key file, to be written outside the intended storage directory with the Nginx UI process privileges.

Affected Versions

• Current dev branch commit checked: 4948fba8744e82c3d7003f68ee164e9f49421066
• Latest release checked: v2.3.10, published 2026-04-28
• The vulnerable filename construction is present in both current dev and v2.3.10.

Security Boundary

The project documentation describes backup.GrantedAccessPath as the critical security boundary for backup operations. It says the setting:

• restricts backup operations to explicitly authorized directories,
• prevents unauthorized access to sensitive system directories,
• enforces administrator-defined boundaries,
• normalizes paths to prevent traversal attempts.

That boundary is enforced for the configured storage_path, but not for the final path after the backup name is appended.

Root Cause

model.AutoBackup.GetName() only trims whitespace and replaces spaces:

func (a *AutoBackup) GetName() string {
    return strings.ReplaceAll(strings.TrimSpace(a.Name), " ", "_")
}

The result is then embedded directly into filenames:

filename := fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)

and for custom directory backups:

filename := fmt.Sprintf("custom_dir_%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)

The API validation rules require name, backup_type, storage_type, storage_path, and cron_expression, but do not reject /, \, or .. in name. ValidateAutoBackupConfig validates backup_path and storage_path, but it does not validate the final outputPath after appending the generated filename.

Relevant paths:

• model/auto_backup.go
• api/backup/auto_backup.go
• internal/backup/auto_backup.go
• internal/backup/utils.go

Proof of Concept

The following local-only reproducer mirrors the relevant code path without contacting any external system:

name := "task/../../../escaped"
filename := fmt.Sprintf("custom_dir_%s_%d.zip", getName(name), int64(1715555555))
outputPath := filepath.Join(storageDir, filename)

Setup:

1. Create a temporary granted directory.
2. Set sourceDir and storageDir under that granted directory.
3. Treat only granted as the allowed path boundary.
4. Use the auto-backup name task/../../../escaped.
5. Create the custom-directory backup using the same filename pattern and zip creation behavior.

Observed output:

granted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted
validated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage
auto_backup_name="task/../../../escaped"
constructed_filename="custom_dir_task/../../../escaped_1715555555.zip"
created_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip
escaped_validated_storage_path=true
created_file_exists=true

The configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory.

A…

Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI