EUVD-2026-97906

Nginx UI: nginx config directive denylist ValidateConfigFile is bypassable via same-line ";" separation → authenticated directive injection RCE on the official image...

CVE-2026-84316

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316 Nginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller...

CVE-2026-84316

The Nginx UI web user interface (versions prior to 2.4.1 ) is vulnerable to a validation bypass in the config.ValidateConfigDirectives function. The software incorrectly splits configuration by newline and only validates the first token, allowing an authenticated caller to append restricted direc...

PT-2026-110974

Name of the Vulnerable Software and Affected Versions Nginx UI versions prior to 2.4.1 Description An authenticated user can bypass configuration validation because the config.ValidateConfigDirectives function only checks the first directive token on each line, ignoring subsequent...