CVE-2026-33026CWE-312CWE-347CWE-354

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

Critical · published March 30, 2026

CVSS v4.0
9.4
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patched in version 2.3.4.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00211 · 10.9th percentile
Weaknesses
CWE-312 · Cleartext Storage of Sensitive Information; CWE-347 · Improper Verification of Cryptographic Signature; CWE-354 · Improper Validation of Integrity Check Value
Published
2026-03-30T19:26Z
EPSS history
Timeline
  • 30 MAR 19:26Z
    nginx-ui Backup Restore Allows Tampering with Encrypted Backups
    cvelistv5