Executive brief
Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI
Affected products
- Go github.com/0xJacky/Nginx-UI
Junglewise Threat Intelligence
CVE-2026-33027: GO-2026-4907 - Nginx Configuration Directory Vulnerable to Recursive Deletion via Improper Path Validation in github.com/0xJacky/Nginx-UI
CVE-2026-33027 · Severity: medium · CVSS 4 · Published 2026-04-02
Technologies: github.com/0xJacky/Nginx-UI (Go). Vendors: Go.
Related threats
- GO-2026-5521 - Nginx-UI: Unauthenticated first-boot instance claim via POST /api/install allows remote bootstrap takeover in github.com/0xJacky/nginx-ui
- GO-2026-5565 - Nginx-UI Settings API Exposes Protected Secrets in github.com/0xJacky/nginx-ui
- GO-2026-5412 - Nginx-UI: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim in github.com/0xJacky/Nginx-UI
- GO-2026-5210 - Nginx-UI: Cross-Site WebSocket Hijacking (CSWSH) via missing origin validation on all WebSocket endpoints in github.com/0xJacky/Nginx-UI
- GO-2026-5227 - Nginx-UI: Authenticated settings disclosure exposes node.secret and enables trusted-node authentication abuse, backup exfiltration, and rest