Nginx UI is a web user interface for the Nginx web server, and a race condition in the application allows concurrent requests to corrupt the core configuration file, app.ini. The absence of a mutex and non‑atomic file writes causes persistent denial of service and opens a non‑deterministic path for remote code execution via configuration cross‑contamination. Attackers could trigger the race by sending simultaneous requests, resulting in service collapse and elevated privileges if the corrupted configuration is leveraged.

The vulnerability affects the Nginx UI application released by 0xJacky, specifically all versions prior to 2.3.4. The patch that resolves the race condition is included in version 2.3.4 and newer releases. No other vendors or products are explicitly listed as affected in the advisory.

The CVSS base score of 7.1 reflects a high severity incident. The EPSS score of less than 1% indicates a low probability of exploitation at this time, and the vulnerability is not currently listed in the CISA KEV catalog. Nonetheless, the attack vector is remote: external clients can access the web UI, and concurrent HTTP requests can trigger the race condition, making the vulnerability exploitable from a remote location and potentially allowing attackers to gain disruptive or higher level control over the host.