CVE-2026-33027

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui configuration improperly handles URL-encoded traversal sequences. When specially crafted paths are supplied, the backend resolves them to the base Nginx configuration directory and executes the operation on the base directory (/etc/nginx). In particular, this allows an authenticated user to remove the entire /etc/nginx directory, resulting in a partial Denial of Service. This issue has been patched in version 2.3.4.

Affected products

Nginx-Ui

Nginxui Nginx Ui

< 2.3.4

Fix

Available

CVSS 4.0

6.9 MEDIUM

CVSS 3.1

6.5 MEDIUM

EPSS

0.4% (33th percentile)

Weakness

CWE-22, CWE-73

NVD status

Analyzed

Published

2026-03-30

No exploit for CVE-2026-33027 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.