Executive brief
Nginx-UI, a management interface for the Nginx web server, contains a flaw in how it handles system backups. An attacker can modify a backup file to include malicious settings and then trick the system into restoring it. This could allow an attacker to take complete control of the server, execute unauthorized commands, or disrupt web services.
Technical details
The vulnerability stems from a circular trust model in the backup/restore architecture of nginx-ui. While backups are encrypted using AES-256-CBC, the encryption key and Initialization Vector (IV) are provided to the client, and the integrity metadata (hash_info.txt) is encrypted with that same key. An attacker with access to the backup token can decrypt the archive, modify configuration files (such as app.ini), recompute SHA-256 hashes, and re-encrypt the package. The restore process fails to strictly enforce integrity, allowing tampered backups to be processed even if warnings are triggered, which can lead to Remote Code Execution (RCE) via malicious configuration parameters like 'StartCmd'.
Affected products
- 0xJacky Nginx-UI < 2.3.4
Timeline
- 2026-03-28: advisory: GitHub Advisory published
- 2026-03-30: disclosed: Public disclosure of CVE-2026-33026
- 2026-03-15: patched: Version 2.3.4 released to address the issue