CVE-2024-49366: 0xJacky nginx-ui, обхождане на път

Описание

Оригинално описание

Nginx UI is a web user interface for the Nginx web server. Nginx UI v2.0.0-beta.35 and earlier gets the value from the json field without verification, and can construct a value value in the form of `../../`. Arbitrary files can be written to the server, which may result in loss of permissions. Version 2.0.0-beta.26 fixes the issue.

Засегнати продукти

• 0xJacky nginx-ui: < 2.0.0-beta.36
• nginxui nginx_ui: преди 2.0.0-beta.36

Вид слабост

• CWE-22 Неправилно ограничаване на път до позволена директория

История

Други уязвимости в 0xJacky nginx-ui

• 7.1CVE-2026-84312
• 8.1CVE-2026-84360
• 8.8CVE-2026-84316
• 8.3CVE-2026-84319
• 8.8CVE-2026-84317

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-49366
• https://nvd.nist.gov/vuln/detail/CVE-2024-49366
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-prv4-rx44-f7jr
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36