{"id":"CVE-2024-49368","title":"Nginx UI is a web user interface for the Nginx web server","summary":"Nginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Vers…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-20"],"vendor":"nginxui","product":"nginx_ui","affected":["nginx_ui <= 1.9.9-4","nginx_ui = 2.0.0"],"published":"2024-10-21","updated":"2026-11-03","sourceUpdated":"2026-11-03T22:17:26.010","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-49368","references":[{"url":"https://github.com/0xJacky/nginx-ui/releases/tag/v2.0.0-beta.36","label":"security-advisories@github.com"},{"url":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-66m6-27r9-77vm","label":"security-advisories@github.com"}],"tags":["nvd","cve.org","exploit-available"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2024-11-01T03:55:23.533080Z"},"scores":{"nvd":9.8,"cna":8.9},"epss":0.27668,"epssPercentile":0.98094,"exploits":{"github":1,"githubRepos":["https://github.com/Aashay221999/CVE-2024-49368"],"checkedAt":"2026-11-07T17:45:03.266Z"},"exploitAvailable":true,"ingestedAt":"2026-11-05T06:38:03.579Z","slug":"CVE-2024-49368","body":"## Overview\n\nNginx UI is a web user interface for the Nginx web server. Prior to version 2.0.0-beta.36, when Nginx UI configures logrotate, it does not verify the input and directly passes it to exec.Command, causing arbitrary command execution. Version 2.0.0-beta.36 fixes this issue.\n\n## Affected\n\n- `nginx_ui <= 1.9.9-4`\n- `nginx_ui = 2.0.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":71,"depthScoreParts":{"impact":53.9,"likelihood":5.5,"exploitation":12,"ransomware":0},"changes":[]}