Vulnerability record · CVE-2024-49368 · published 21 October 2024

CVE-2024-49368: Nginxui nginx ui improper input validation vulnerability

Nginxui · Nginx Ui

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.

8.9 CVSS 4.0 High EPSS 28% · top 2.0% CWE-20 · Improper input validation

8.9CVSS 4.0 base score

28%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

2References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Nginx Ui Nginxui

References

Link	Tags
https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36	Release Notes
https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm	ExploitVendor Advisory

Track CVE-2024-49368 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.9CVE-2026-44015Nginxui nginx ui server-side request forgery (ssrf) vulnerabilityNginx UI is a web user interface for the Nginx web server. In 2.3.4 and earlier, an authenticated user can perform Server-Side Request Forgery (SSRF)…EPSS 0.39%12 May 2026 9.9CVE-2026-33030Nginxui nginx ui os command injection vulnerabilityNginx UI is a web user interface for the Nginx web server. In versions 2.3.3 and prior, Nginx-UI contains an Insecure Direct Object Reference (IDOR) …EPSS 0.38%30 Mar 2026 9.8CVE-2026-42221Nginxui nginx ui missing authentication for critical function vulnerabilityNginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker can claim …EPSS 1.6%4 May 2026 9.8CVE-2026-42222Nginxui nginx ui improper access control vulnerabilityNginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during the init…EPSS 0.47%4 May 2026 9.8CVE-2026-33032Nginxui nginx ui missing authentication for critical function vulnerabilityNginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes…EPSS 2.5%30 Mar 2026 9.8CVE-2026-27944Nginxui nginx ui missing authentication for critical function vulnerabilityNginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and …EPSS 1.0%5 Mar 2026 9.8CVE-2024-23827Nginxui nginx ui path traversal vulnerabilityNginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does n…EPSS 0.70%29 Jan 2024 9.4CVE-2026-33026Nginxui nginx ui cleartext storage of sensitive data vulnerabilityNginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper w…EPSS 0.21%30 Mar 2026

Source: NIST National Vulnerability Database (record CVE-2024-49368), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.