The vulnerability resides in the logrotate configuration of Nginx UI. Before version 2.3.4 the backend does not validate the rotation interval field. Submitting a negative integer causes an infinite loop or an unusable state, making the web interface unresponsive. The weakness is a classic input validation flaw (CWE‑20). The impact is limited to denial of service; no disclosure or execution of arbitrary code is possible from this flaw.

The product affected is Nginx UI released by 0xJacky. All releases older than version 2.3.4 are vulnerable. The issue was fixed in release 2.3.4, so upgrades to that version or later remove the risk.

The CVSS score of 6.9 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. However, exploitation requires authentication as the attacker must submit a configuration change. If an attacker gains authentication, they can cause a service outage. The overall risk remains moderate, with the primary concern being availability compromise.