Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

{
  "id": "918198edf409f115be61fa2273e14a10034ce8aef711510fca3d3db60d8b975e",
  "url": "https://osv.dev/vulnerability/GHSA-cf23-7qxj-xmhr",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line \";\" separation → authenticated directive injection (RCE on the official image)",
    "summary": "## Summary `config.ValidateConfigFile` is the security control that blocks dangerous nginx directives (`js_*`, `perl_*`, `load_module` of njs/perl modules, `user root`). Its directive scanner is bypassable: it splits the config by newlines and inspects only the FIRST token of each line, but nginx separates directives with `;`, not newlines. Putting a benign directive first and the blocked directive after a `;` on the SAME line defeats every check. The `include` directive is also not on the denylist. As a result, an authenticated caller can inject the exact directives the hardening was meant to block, through EVERY path that calls the validator — `POST /api/configs` (add), the REST config modify endpoint (api/config/modify.go), the MCP `nginx_config_modify` tool, and the site/stream save paths (internal/site/save.go, internal/stream/save.go). On deployments where nginx has the njs/perl module (the official uozi/nginx-ui Docker image ships ngx_http_js_module.so), this leads to code execution in the nginx worker; with `user root` the workers run as root. This is distinct from the config_add gap (the MCP nginx_config_add tool not calling the validator at all): here the validator IS called and still bypassed, so fixing config_add does not fix this. ## Root cause (internal/config/validation.go, ValidateConfigDirectives) ```go for _, line := range bytes.Split(content, []byte(\"\\n\")) { // splits on \\n only trimmed := strings.TrimSpace(string(line)) ... directive := firstDirectiveToken",
    "evidence": "osv:GHSA-cf23-7qxj-xmhr",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260703131214-23d1934099b0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "GHSA-cf23-7qxj-xmhr",
      "aliases": [
        "CVE-2026-84316",
        "GHSA-cf23-7qxj-xmhr",
        "GO-2026-6782"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.10-0.20260703131214-23d1934099b0"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-cf23-7qxj-xmhr/GHSA-cf23-7qxj-xmhr.json"
          }
        }
      ],
      "modified": "2026-10-19T21:41:05.726665020Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84316",
        "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2",
        "https://github.com/0xJacky/nginx-ui",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-184",
          "CWE-20"
        ],
        "severity": "HIGH",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-12T21:17:22Z",
        "github_reviewed_at": "2026-10-15T20:13:52Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84316",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 376772,
  "published_at": "2026-10-15T20:13:52+00:00"
}

{
  "id": "01c7f90a6eb6ff084d73769f3de680952c279dfb2fb5bb21d4614962a0a6b5e9",
  "url": "https://osv.dev/vulnerability/GO-2026-6782",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line \";\" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI",
    "summary": "Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line \";\" separation → authenticated directive injection (RCE on the official image) in github.com/0xJacky/Nginx-UI",
    "evidence": "osv:GO-2026-6782",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260703131214-23d1934099b0",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6782",
      "aliases": [
        "CVE-2026-84316",
        "GHSA-cf23-7qxj-xmhr",
        "GO-2026-6782"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.10-0.20260703131214-23d1934099b0"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6782.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-19T21:31:50.614201466Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84316",
        "https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6782",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84316",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 376699,
  "published_at": "2026-10-19T21:08:35+00:00"
}