---
cve: "CVE-2026-84316"
severity: "HIGH"
cvss: 8.8
epss: "0.5%"
vendor: "0xJacky"
kev: false
exploited: false
published: "2026-10-12 21:17:22"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-11-10T18:50:01+01:00"
---

# CVE-2026-84316

> 8.8 HIGH · 🧪 PoC

## Beschreibung

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-10-13 14:48:55
- CNA-CVSS: **8.8** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **poc**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-20** — Improper Input Validation
  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- **CWE-184** — Incomplete List of Disallowed Inputs
  The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.

## Angriffsmuster (CAPEC)

- [CAPEC-10 — Buffer Overflow via Environment Variables](https://capec.mitre.org/data/definitions/10.html) _(Severity: High)_
- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-101 — Server Side Include (SSI) Injection](https://capec.mitre.org/data/definitions/101.html) _(Severity: High)_
- [CAPEC-104 — Cross Zone Scripting](https://capec.mitre.org/data/definitions/104.html) _(Severity: High)_
- [CAPEC-108 — Command Line Execution through SQL Injection](https://capec.mitre.org/data/definitions/108.html) _(Severity: Very High)_
- [CAPEC-109 — Object Relational Mapping Injection](https://capec.mitre.org/data/definitions/109.html) _(Severity: High)_
- [CAPEC-110 — SQL Injection through SOAP Parameter Tampering](https://capec.mitre.org/data/definitions/110.html) _(Severity: Very High)_
- [CAPEC-120 — Double Encoding](https://capec.mitre.org/data/definitions/120.html) _(Severity: Medium)_

## ATT&CK-Techniken

- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)

## Patch verfügbar (OSV)

- 0540f3ecf7824e9adbe408f3166d151651ccf4dd (Commit)
- 23d1934099b05b2a01589b48129dc3d3159d91c2 (Commit)

## BSI-Hinweise (deutsch)

- [nginx-ui: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-2390) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in nginx-ui ausnutzen, um beliebigen Code auszuführen, einschließlich der Codeausführung mit Root-Rechten; erweiterte Rechte zu erlangen; eine Kontoübernahme durchzuführen; Sicherheitsmaßnahmen zu umgehen; oder Daten offenzulegen und zu manipulieren.

## Referenzen

- <https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-cf23-7qxj-xmhr>
- <https://github.com/0xJacky/nginx-ui/commit/23d1934099b05b2a01589b48129dc3d3159d91c2>
- <https://github.com/0xJacky/nginx-ui/releases/tag/v2.4.1>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-84316/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_