CVE-2026-2145

Vulnerability

Overview CVE-2026-2145 describes a reflected cross-site scripting (XSS) vulnerability in cym1102's nginxWebUI up to version 4.3.7. The bug resides in the adminPage/conf/check endpoint of the Web Management Interface. The nginxDir parameter is not sanitized before being echoed back to the user, allowing an attacker to inject arbitrary HTML and JavaScript. The project maintainer has been notified via an issue report but has not yet responded [1][2][3].

Attack

Vector and Exploitation The vulnerability can be triggered remotely by an unauthenticated (or any authenticated) user sending a crafted request to the vulnerable endpoint. The issue was demonstrated by entering `` into the "nginx directory" input field and pressing "Verify File". The backend processes and returns the input without HTML encoding, causing the script to execute in the victim's browser [2][3]. The exploit is publicly available and might be used in attacks [1].

Impact

An attacker exploiting this XSS can steal session cookies, hijack user accounts, or deliver malicious content to other users of the management interface. Because nginxWebUI is used to manage Nginx configurations and clusters, compromising an administrative session could lead to broader control over the web server configuration [2][3].

Mitigation

No official patch has been released as of February 2026; the project has not responded to the issue report. Users should apply output encoding (e.g., HTML entity encoding) for the nginxDir parameter or implement Content Security Policy (CSP) headers to reduce the risk. Until a fix is available, administrators should restrict access to the web management interface to trusted networks only [2][3].