### [CVE-2024-23827](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23827)
![](https://img.shields.io/static/v1?label=Product&message=nginx-ui&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%20%3C%202.0.0.beta.12%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-22%3A%20Improper%20Limitation%20of%20a%20Pathname%20to%20a%20Restricted%20Directory%20('Path%20Traversal')&color=brighgreen)

### Description

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the vulnerability into a remote code execution overwriting the config file app.ini. Version 2.0.0.beta.12 fixed the issue.

### POC

#### Reference
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-xvq9-4vpv-227m

#### Github
No PoCs found on GitHub currently.