CVE-2026-33027 Nginx UI: Improper Path Validation Allows Recursive Deletion of the Nginx Configuration Directory
An authenticated attacker can exploit improper path validation to recursively delete the Nginx configuration directory, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33027?
CVE-2026-33027 is a medium-severity path traversal vulnerability in 0xJacky nginx-ui, published on 30 Mar 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.
Which versions are affected by CVE-2026-33027?
3 open source packages ship an affected version, including github.com/0xJacky/Nginx-UI. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/0xJacky/Nginx-UI Go | All versions | None |
github.com/0xJacky/Nginx-UI Go | All versions to 1.99 | None |
github.com/0xJacky/Nginx-UI Go | All versions to 1.99 | None |
Products include Nginxui Nginx Ui.
How do I fix CVE-2026-33027?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-33027 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33027 exists.
Other vulnerabilities in 0xJacky nginx-ui
- CVE-2026-33032 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover
- CVE-2026-27944 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure
- CVE-2024-23827 Nginx-UI arbitrary file write through the Import Certificate feature
- CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
- CVE-2026-33026 nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Sources
Also known as GHSA-m8p8-53vf-8357, GO-2026-4907.