CVE-2026-40519 is an authenticated remote code execution vulnerability in Nginx Proxy Manager's setupCertbotPlugins() function located in backend/setup.js. The vulnerability arises because the user-controlled dns_provider_credentials value is directly interpolated into a shell command executed via child_process.exec() without proper sanitization or escaping. This allows attackers with certificates:manage permission to inject and execute arbitrary OS commands when the backend restarts. The affected versions include 2.9.14 through 2.15.1, with a fix committed in a5db5ed. The CVSS 4.0 score is 7.7, indicating a high severity vulnerability.

An attacker with authenticated access and certificates:manage permission can execute arbitrary OS commands on the backend server. This can lead to full system compromise, data theft, or disruption of service. The vulnerability requires authentication but does not require user interaction beyond permission to manage certificates.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the fix is referenced by a commit (a5db5ed) but no official patch or release is confirmed, users should monitor the vendor's advisories for an official update. Until patched, restrict certificates:manage permissions to trusted users only and avoid backend restarts with untrusted dns_provider_credentials values.