CVE-2026-84320: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in 0xJacky nginx-ui

Nginx UI versions before 2.4.3 improperly limit pathname resolution for automatic backup storage paths. Although the storage_path is validated, the AutoBackup.GetName function returns a user-controlled name without filtering out path separators or parent-directory components. This allows filepath.Join to resolve the final archive path outside the validated directory. Consequently, an authenticated user with backup creation or modification rights can cause backup archives and adjacent encryption key files to be written outside the intended directory with nginx-ui process privileges. This vulnerability is addressed in version 2.4.3.

An authenticated user with permission to create or modify automatic backups can exploit this vulnerability to write files outside the designated backup storage directory. This unauthorized file write can lead to potential data integrity issues and exposure of sensitive files, including encryption key files for configuration backups. The impact includes limited confidentiality, integrity, and availability loss as indicated by the CVSS score of 6.3.

Upgrade nginx-ui to version 2.4.3 or later, where this path traversal vulnerability is fixed. No other mitigation is required as the issue is resolved in the official patch.