CVE-2026-90581
cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 13, 2026
- Updated
- Sep 14, 2026
- Reserved
- Sep 12, 2026
Description
A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 6.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 3.0 | 6.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R | VulDB |
| 2.0 | 6.5 Medium | AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
nginxWebUIcym1102 |
|
References
- VDB-403166 | cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injectionvdb-entrytechnical-description
- VDB-403166 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-90581 | CVE Analysis and Reportthird-party-advisory
- Submit #913328 | cym1102 nginxWebUI 4.4.2 Code Injectionthird-party-advisory
- https://github.com/cym1102/nginxWebUI/issues/213exploitissue-tracking
- https://github.com/cym1102/nginxWebUI/pull/215issue-trackingpatch
- https://github.com/cym1102/nginxWebUI/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.