https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 00:06:58 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06993 bdu:2026-06993 https://cve.radiocsirt.org/vuln/bdu:2026-06993 https://cve.radiocsirt.org/vuln/euvd-2026-278270 EUVD-2026-278270 https://cve.radiocsirt.org/vuln/euvd-2026-278270 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33026 <p>Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.</p> <p>Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-33026 https://cve.radiocsirt.org/vuln/ghsa-fhh2-gg7w-gwpq <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>## Summary The `nginx-ui` backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration.</p> <p>## Details The backup format lacks a trusted integrity root. Although files are encrypted, the encryption key and IV are provided to the client and the integrity metadata (`hash_info.txt`) is encrypted using the same key. As a result, an attacker who can access the backup token can decrypt the archive, modify its contents, recompute integrity hashes, and re-encrypt the bundle.</p> <p>Because the restore process does not enforce integrity verification and accepts backups even when hash mismatches are detected, the system restores attacker-controlled configuration even when integrity verification warnings are raised. In certain configurations this may lead to arbitrary command execution on the host.</p> <p>The backup system is built around the following workflow:</p> <p>1. Backup files are compressed into `nginx-ui.zip` and `nginx.zip`. 2. The files are encrypted using AES-256-CBC. 3. SHA-256 hashes of the encrypted files are stored in `hash_info.txt`. 4. The hash file is also encrypted with the same AES key and IV. 5. The AES key and IV are provided to the client as a &#34;backup security token&#34;.</p> <p>This architecture creates a circular trust model:</p> <p>- The encryption key is available to the client. - The integrity metadata is encrypted with that same key. - The restore process trusts hashes contained within the backup itself.</p> <p>Because the…</p> <p><strong>Affected:</strong> Go: github.com/0xJacky/Nginx-UI</p> <p>## Summary The `nginx-ui` backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration.</p> <p>## Details The backup format lacks a trusted integrity root. Although files are encrypted, the encryption key and IV are provided to the client and the integrity metadata (`hash_info.txt`) is encrypted using the same key. As a result, an attacker who can access the backup token can decrypt the archive, modify its contents, recompute integrity hashes, and re-encrypt the bundle.</p> <p>Because the restore process does not enforce integrity verification and accepts backups even when hash mismatches are detected, the system restores attacker-controlled configuration even when integrity verification warnings are raised. In certain configurations this may lead to arbitrary command execution on the host.</p> <p>The backup system is built around the following workflow:</p> <p>1. Backup files are compressed into `nginx-ui.zip` and `nginx.zip`. 2. The files are encrypted using AES-256-CBC. 3. SHA-256 hashes of the encrypted files are stored in `hash_info.txt`. 4. The hash file is also encrypted with the same AES key and IV. 5. The AES key and IV are provided to the client as a &#34;backup security token&#34;.</p> <p>This architecture creates a circular trust model:</p> <p>- The encryption key is available to the client. - The integrity metadata is encrypted with that same key. - The restore process trusts hashes contained within the backup itself.</p> <p>Because the…</p> https://cve.radiocsirt.org/vuln/ghsa-fhh2-gg7w-gwpq https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0931 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um sich Administratorrechte zu verschaffen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand herbeizuführen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um sich Administratorrechte zu verschaffen, beliebigen Code auszuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0931