Most recent entries from all

bdu:2026-02720

EUVD-2026-276567

fkie_cve-2026-27944

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately. This issue has been patched in version 2.3.3.

GHSA-g9w5-qffc-6762 — Nginx-UI Vulnerable to Unauthenticated Backup Download with Encryption Key Disclosure

Affected: Go: github.com/0xJacky/Nginx-UI

## Summary

The `/api/backup` endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the `X-Backup-Security` response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private keys, Nginx configurations) and decrypt it immediately.

## Vulnerability Details

| Field | Value | |-------|-------| | CWE | CWE-306: Missing Authentication for Critical Function + CWE-311: Missing Encryption of Sensitive Data | | Affected File | `api/backup/router.go` | | Affected Function | `CreateBackup` (lines 8-11 in router, implementation in `api/backup/backup.go:13-38`) | | Secondary File | `internal/backup/backup.go` | | CVSS 3.1 | 9.8 (Critical) | | CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |

## Root Cause

The vulnerability exists due to two critical security flaws:

### 1. Missing Authentication on /api/backup Endpoint

In `api/backup/router.go:9`, the backup endpoint is registered without any authentication middleware:

```go func InitRouter(r *gin.RouterGroup) { r.GET("/backup", CreateBackup) // No authentication required r.POST("/restore", middleware.EncryptedForm(), RestoreBackup) // Has middleware } ```

For comparison, the restore endpoint correctly uses middleware, while the backup endpoint is completely open.

### 2. Encryption Keys Disclosed in HTTP Response Headers

In `api/backup/backup.go:22-33`, the AES…

WID-SEC-W-2026-0712 — nginx-ui: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in nginx-ui ausnutzen, um Sicherheitsvorkehrungen zu umgehen und so eine vollständige Systembackup mit sensiblen Daten offenzulegen und zu entschlüsseln.