https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T01:07:58.760462+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-06993 bdu:2026-06993 2026-10-04T01:07:58.874401+00:00 bdu:2026-06993 https://cve.radiocsirt.org/vuln/euvd-2026-278270 EUVD-2026-278270 2026-10-04T01:07:58.874444+00:00 EUVD-2026-278270 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33026 fkie_cve-2026-33026 2026-10-04T01:07:58.874458+00:00

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

 https://cve.radiocsirt.org/vuln/ghsa-fhh2-gg7w-gwpq GHSA-fhh2-gg7w-gwpq — nginx-ui Backup Restore Allows Tampering with Encrypted Backups 2026-10-04T01:07:58.874489+00:00

Affected: Go: github.com/0xJacky/Nginx-UI

## Summary The `nginx-ui` backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration.

## Details The backup format lacks a trusted integrity root. Although files are encrypted, the encryption key and IV are provided to the client and the integrity metadata (`hash_info.txt`) is encrypted using the same key. As a result, an attacker who can access the backup token can decrypt the archive, modify its contents, recompute integrity hashes, and re-encrypt the bundle.

Because the restore process does not enforce integrity verification and accepts backups even when hash mismatches are detected, the system restores attacker-controlled configuration even when integrity verification warnings are raised. In certain configurations this may lead to arbitrary command execution on the host.

The backup system is built around the following workflow:

1. Backup files are compressed into `nginx-ui.zip` and `nginx.zip`. 2. The files are encrypted using AES-256-CBC. 3. SHA-256 hashes of the encrypted files are stored in `hash_info.txt`. 4. The hash file is also encrypted with the same AES key and IV. 5. The AES key and IV are provided to the client as a "backup security token".

This architecture creates a circular trust model:

- The encryption key is available to the client. - The integrity metadata is encrypted with that same key. - The restore process trusts hashes contained within the backup itself.

Because the…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0931 WID-SEC-W-2026-0931 — nginx-ui: Mehrere Schwachstellen 2026-10-04T01:07:58.874562+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um sich Administratorrechte zu verschaffen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand herbeizuführen.