Executive brief
NGINX Agent and Instance Manager are tools used to manage and monitor NGINX web server instances. A vulnerability in how these tools handle directory configurations allows a user with low-level access to read or write files outside of their authorized folders. This could lead to the exposure of sensitive configuration data or unauthorized modification of system files, potentially compromising the integrity of the managed web servers.
Technical details
A path traversal vulnerability (CWE-22) exists in the NGINX Agent 'config_dirs' directive, which can also be configured via NGINX Instance Manager. The flaw allows a remotely authenticated attacker with low privileges to bypass directory restrictions and perform limited read/write operations on files outside the intended secure scope. This occurs because the application fails to properly sanitize or validate the directory paths specified in the configuration. The vulnerability is confirmed in NGINX Agent versions 2.x prior to 2.47.0 and NGINX Instance Manager versions 2.17.1 through 2.22.1. Users are advised to upgrade to NGINX Agent 2.47.0 or 3.0.0, and NGINX Instance Manager 2.22.2 or later.
Affected products
- F5 NGINX Agent 2.0.0 to 2.46.0
- F5 NGINX Instance Manager 2.17.1 to 2.22.1
Timeline
- 2026-07-15: advisory: F5 published security advisory K000161971
- 2026-07-15: disclosed: CVE-2026-60062 published to NVD