VDB
CVE-2026-33026
CVE-2026-33026
PUBLISHED
CVSS 9.4 CRITICAL
nginx-ui Backup Restore Allows Tampering with Encrypted Backups
Reported by github_m · Published March 30, 2026
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.
Risk scores
CVSS 4.0
9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
| Vendor | Product | Versions |
|---|---|---|
| 0xJacky | nginx-ui | < 2.3.4 |
| 0xJacky | nginx-ui | 0 |
| github.com | 0xJacky/Nginx-UI | 0 |
Timeline
- Mar 28, 2026 PoC Published (5 in total, the first dated here)
- Mar 30, 2026 CVE Published
- Mar 31, 2026 CVE Updated
- May 18, 2026 EPSS Score (30 in total, the first dated here)
- Jun 1, 2026 Security Advisory
- Jun 7, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-33026
vulnetix vdb fixes CVE-2026-33026Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-33026/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-fhh2-gg7w-gwpq x_refsource_CONFIRM
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.4 x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2026-33026 advisory
- https://github.com/advisories/GHSA-fhh2-gg7w-gwpq advisory
- https://github.com/advisories/GHSA-g9w5-qffc-6762 advisory
- https://github.com/0xJacky/nginx-ui/commit/f61bcec547c0f305e35348d6440ef156c1d5c3cb patch
- https://pkg.go.dev/vuln/GO-2026-4903 url
- https://github.com/0xJacky/nginx-ui url