This vulnerability affects cym1102 nginxWebUI up to version 4.4.2. It arises from improper handling of the 'url' argument in the MainController.autoUpdate function, allowing an attacker to inject code remotely. The vulnerability has been publicly disclosed, and exploit code may be available. However, the fix is not yet officially released, as the pull request addressing the issue awaits acceptance.

Successful exploitation allows remote attackers to perform code injection via the 'url' parameter in the autoUpdate function, potentially leading to unauthorized code execution. The CVSS 4.0 base score is 5.3 (medium severity), indicating a moderate impact with network attack vector, low attack complexity, and no user interaction required.

A fix for this vulnerability is not yet officially available. The vendor has a pull request pending acceptance to address the issue. Until the patch is accepted and released, users should exercise caution when exposing the affected functionality and consider applying temporary controls such as input validation or restricting access to the vulnerable endpoint. Monitor the vendor advisory for updates on the patch status.