Nginx UI: Auto backup name allows path traversal outside validated storage path

{
  "id": "46c906189b4b5c4dd49754c6aefd53d30b5184ecb131a38d6adaa884d2d5d2cb",
  "url": "https://osv.dev/vulnerability/GHSA-jrq7-xrjx-pcfw",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: Auto backup name allows path traversal outside validated storage path",
    "summary": "## Summary Nginx UI validates `backup_path` and `storage_path` against the administrator-defined `backup.GrantedAccessPath` boundary, but the final auto-backup output filename is built from the user-controlled auto-backup `name` without stripping path separators or `..` components. An authenticated user who can create or modify an auto-backup task can set a name such as `task/../../../escaped`. The configured `storage_path` still passes validation because it is inside `GrantedAccessPath`, but the generated backup path escapes that storage directory when `filepath.Join(storage_path, filename)` resolves the embedded traversal sequence. This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent `.key` file, to be written outside the intended storage directory with the Nginx UI process privileges. ## Affected Versions - Current `dev` branch commit checked: `4948fba8744e82c3d7003f68ee164e9f49421066` - Latest release checked: `v2.3.10`, published 2026-04-28 - The vulnerable filename construction is present in both current `dev` and `v2.3.10`. ## Security Boundary The project documentation describes `backup.GrantedAccessPath` as the critical security boundary for backup operations. It says the setting: - restricts backup operations to explicitly authorized directories, - prevents unauthorized access to sensitive system directories, - enforces administrator-defined boundaries, - normalizes paths to prevent traver",
    "evidence": "osv:GHSA-jrq7-xrjx-pcfw",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260715121709-f92218e01054",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-jrq7-xrjx-pcfw",
      "aliases": [
        "CVE-2026-84320",
        "GHSA-jrq7-xrjx-pcfw",
        "GO-2026-6788"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.10-0.20260715121709-f92218e01054"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-jrq7-xrjx-pcfw/GHSA-jrq7-xrjx-pcfw.json"
          }
        }
      ],
      "modified": "2026-10-19T21:40:47.037315547Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84320",
        "https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb",
        "https://github.com/0xJacky/nginx-ui",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-22"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-12T21:17:22Z",
        "github_reviewed_at": "2026-10-15T20:10:56Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84320",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 376739,
  "published_at": "2026-10-15T20:10:56+00:00"
}

{
  "id": "107b05779c44bcf0c392d9bf510b50a409302c1d2a661a60fd7fd85edd775d7a",
  "url": "https://osv.dev/vulnerability/GO-2026-6788",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI",
    "summary": "Nginx UI: Auto backup name allows path traversal outside validated storage path in github.com/0xJacky/Nginx-UI",
    "evidence": "osv:GO-2026-6788",
    "products": [
      {
        "name": {
          "value": "github.com/0xJacky/Nginx-UI",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.9.10-0.20260715121709-f92218e01054",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6788",
      "aliases": [
        "CVE-2026-84320",
        "GHSA-jrq7-xrjx-pcfw",
        "GO-2026-6788"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.9.10-0.20260715121709-f92218e01054"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/0xJacky/Nginx-UI",
            "purl": "pkg:golang/github.com/0xJacky/Nginx-UI",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6788.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-19T21:31:50.619731740Z",
      "provider": "osv",
      "references": [
        "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-jrq7-xrjx-pcfw",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-84320",
        "https://github.com/0xJacky/nginx-ui/commit/f92218e01054491fc1e6684dc6f7facaf8ab41eb",
        "https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.3"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6788",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-84320",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 376701,
  "published_at": "2026-10-19T21:08:35+00:00"
}