Is CVE-2026-84320 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84320 being exploited in the wild.

How severe is CVE-2026-84320?

Medium severity, with a CVSS score of 6.3, published 12 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260715121709-f92218e01054, SEMVER:introduced=0,fixed=1.9.10-0.20260715121709-f92218e01054; Nginx UI v2.3.10 and dev branch (commit 4948fba8744e82c3d7003f68ee164e9f49421066).

How is CVE-2026-84320 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-84320?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84320: Nginx UI auto backup path traversal in storage boundary

Q: Is there a fix for CVE-2026-84320?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260715121709-f92218e01054 or later. Until then: Reject path separators (`/`, `\`), parent directory references (`..`), and NUL bytes in auto-backup task names through input validation. Additionally, after constructing the final output path, verify that the cleaned path remains within the validated `storage_path` boundary before writing the backup file. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84320 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-84320?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84320 · Severity: medium · CVSS 6.3 · Published 2026-10-12

Nginx UI, a web-based configuration management tool for Nginx, enforces a security boundary to restrict backup file storage to administrator-approved directories. However, an authenticated user can create backup tasks with names containing path traversal sequences (such as `../../../`) that bypass this boundary and write backup files outside the intended storage directory. Backups may contain sensitive Nginx configuration, databases, and encryption keys, potentially exposing them in unauthorized locations.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-84320 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84320 being exploited in the wild.
How severe is CVE-2026-84320?: Medium severity, with a CVSS score of 6.3, published 12 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) < 1.9.10-0.20260715121709-f92218e01054, SEMVER:introduced=0,fixed=1.9.10-0.20260715121709-f92218e01054; Nginx UI v2.3.10 and dev branch (commit 4948fba8744e82c3d7003f68ee164e9f49421066).
Is there a fix for CVE-2026-84320?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260715121709-f92218e01054 or later. Until then: Reject path separators (`/`, `\`), parent directory references (`..`), and NUL bytes in auto-backup task names through input validation. Additionally, after constructing the final output path, verify that the cleaned path remains within the validated `storage_path` boundary before writing the backup file. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84320 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-84320?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260715121709-f92218e01054 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260715121709-f92218e01054
```

Reject path separators (`/`, `\`), parent directory references (`..`), and NUL bytes in auto-backup task names through input validation. Additionally, after constructing the final output path, verify that the cleaned path remains within the validated `storage_path` boundary before writing the backup file.

Technical details

The vulnerability is a path traversal flaw in the auto-backup filename construction. The `AutoBackup.GetName()` method only trims whitespace and spaces but does not sanitize path separators or traversal sequences; when combined with `filepath.Join(storage_path, filename)`, this allows an authenticated attacker to embed `../` components in the backup name that escape the validated storage directory. The root cause is that `storage_path` validation passes but the final output path after appending the unsanitized backup name is never validated against the `GrantedAccessPath` boundary. This enables writing backup archives and associated key files outside the intended directory with the Nginx UI process privileges.

Affected products

Nginx UI Nginx UI v2.3.10 and dev branch (commit 4948fba8744e82c3d7003f68ee164e9f49421066)

Identifiers

CVE-2026-84320
GHSA-jrq7-xrjx-pcfw
GO-2026-6788

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.