| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/0xJacky/Nginx-UI | < 1.9.10-0.20260715121709-f92218e01054 | 1.9.10-0.20260715121709-f92218e01054 |
Nginx UI validates backup_path and storage_path against the administrator-defined backup.GrantedAccessPath boundary, but the final auto-backup output filename is built from the user-controlled auto-backup name without stripping path separators or .. components.
An authenticated user who can create or modify an auto-backup task can set a name such as task/../../../escaped. The configured storage_path still passes validation because it is inside GrantedAccessPath, but the generated backup path escapes that storage directory when filepath.Join(storage_path, filename) resolves the embedded traversal sequence.
This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent .key file, to be written outside the intended storage directory with the Nginx UI process privileges.
dev branch commit checked: 4948fba8744e82c3d7003f68ee164e9f49421066v2.3.10, published 2026-04-28dev and v2.3.10.The project documentation describes backup.GrantedAccessPath as the critical security boundary for backup operations. It says the setting:
That boundary is enforced for the configured storage_path, but not for the final path after the backup name is appended.
model.AutoBackup.GetName() only trims whitespace and replaces spaces:
func (a *AutoBackup) GetName() string {
return strings.ReplaceAll(strings.TrimSpace(a.Name), " ", "_")
}
The result is then embedded directly into filenames:
filename := fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)
and for custom directory backups:
filename := fmt.Sprintf("custom_dir_%s_%d.zip", autoBackup.GetName(), time.Now().Unix())
outputPath = filepath.Join(autoBackup.StoragePath, filename)
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThe API validation rules require name, backup_type, storage_type, storage_path, and cron_expression, but do not reject /, \, or .. in name. ValidateAutoBackupConfig validates backup_path and storage_path, but it does not validate the final outputPath after appending the generated filename.
Relevant paths:
model/auto_backup.goapi/backup/auto_backup.gointernal/backup/auto_backup.gointernal/backup/utils.goThe following local-only reproducer mirrors the relevant code path without contacting any external system:
name := "task/../../../escaped"
filename := fmt.Sprintf("custom_dir_%s_%d.zip", getName(name), int64(1715555555))
outputPath := filepath.Join(storageDir, filename)
Setup:
granted directory.sourceDir and storageDir under that granted directory.granted as the allowed path boundary.task/../../../escaped.Observed output:
granted_root=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted
validated_storage_path=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/granted/storage
auto_backup_name="task/../../../escaped"
constructed_filename="custom_dir_task/../../../escaped_1715555555.zip"
created_file=/Users/jagadeshachanta/.cache/tmp/nginx-ui-autobackup-poc-1538710430/escaped_1715555555.zip
escaped_validated_storage_path=true
created_file_exists=true
The configured storage path is inside the granted directory, but the created backup file is outside both the storage directory and the granted directory.
A repo-local regression test was also prepared at:
internal/backup/auto_backup_path_traversal_poc_test.go
The test cannot currently be executed cleanly in this checkout because unrelated build prerequisites fail before the package test runs:
app/app.go: pattern all:dist: no matching files found
model/cert.go: no required module provides package github.com/go-acme/lego/v5/certificate
internal/helper/key_type.go: no required module provides package github.com/go-acme/lego/v5/certcrypto
The standalone reproducer output above was therefore used as the executable proof for this report.
An authenticated user with access to the auto-backup API can bypass the administrator-configured backup storage boundary. Depending on filesystem permissions and deployment layout, this can:
storage_path,storage_path,This is especially relevant because backup archives may contain Nginx UI configuration, database files, Nginx configuration, and for encrypted config backups the adjacent key file required to decrypt the archive.
Recommended defense in depth:
name as a display label only, not as a filesystem path component.filepath.Base or a strict allowlist such as [A-Za-z0-9._-]... segments in name.outputPath, clean it and validate that the final path remains inside the already-validated storage_path.Example invariant:
cleanOutput := filepath.Clean(outputPath)
cleanStorage := filepath.Clean(autoBackup.StoragePath) + string(filepath.Separator)
if !strings.HasPrefix(cleanOutput, cleanStorage) {
return ErrPathNotInGrantedAccess
}
This was tested only in a local isolated environment against source code and temporary directories. No online demo systems or production systems were tested.
AI assistance was used to inspect the open-source code, prepare the local reproducer, and draft this report. The issue and PoC output were verified locally before submission.