A race condition in the Nginx UI web interface, caused by the absence of synchronization mechanisms and non‑atomic file writes, corrupts the primary configuration file (app.ini). This corruption is persistent, leading to a denial of service for the UI and potentially creating a non‑deterministic path to remote code execution through configuration cross‑contamination as the corrupted configuration may be interpreted unexpectedly.

The vulnerability affects the 0xJacky Nginx UI application. All installations running versions earlier than 2.3.4 are potentially impacted. No other versions are listed as affected.

The CVSS score is 7.1, indicating high severity. EPSS information is not provided, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack can be carried out remotely by sending concurrent web requests to the Nginx UI over the network; no local privileged access is required. The race condition depends on timing, which may make exploitation non‑deterministic, but the persistence of the corrupt configuration makes mitigation essential.