Nginx UI allows an authenticated user to supply specially crafted, URL‑encoded traversal sequences that the backend resolves to the base Nginx configuration directory (/etc/nginx). This flaw permits the deletion of that entire directory, causing a partial denial of service by removing essential configuration files. The weakness is a path traversal/bounded directory removal (CWE‑22, CWE‑73).

The vulnerability affects the 0xJacky Nginx UI product before version 2.3.4. Users deploying Nginx UI v2.3.3 or earlier are exposed.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests that exploitation is unlikely to be widespread. The vulnerability is not listed in KEV. Exploitation requires authentication to the web UI; an attacker must first obtain valid credentials or local access. If authenticated, the attacker can craft a URL containing traversal sequences to trigger deletion of the configuration directory.