The flaw occurs when the Nginx UI automatic backup feature accepts a backup name that includes path separators or parent-directory components, a classic CWE-22 path traversal weakness. The application then builds the archive filename without sanitizing these components. An authenticated user who can create or modify a backup can trigger the path resolution in such a way that the resulting archive is written outside the directory that the application is meant to use for backups. The same path traversal also allows the encryption key file for encrypted backups to be created outside the validated directory. The consequence is an unauthorized write with the privileges of the Nginx UI process, enabling potential tampering of configuration files or other sensitive data.

The vulnerability affects the Nginx UI web interface issued by 0xJacky. All releases prior to version 2.4.3 are vulnerable; the issue was fixed in the 2.4.3 release and later versions.

The CVSS score of 6.3 categorizes this issue as a medium severity problem. Exploitation requires an authenticated user with backup creation or modification rights, and no public remote exploitation method is documented. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalogue, indicating limited real-world exploitation evidence. Nonetheless, because the flaw permits path traversal, a skilled attacker could write arbitrary files anywhere that the Nginx UI process can access, potentially facilitating privilege escalation or configuration compromise. The risk is therefore significant for systems where the backup directory is not tightly constrained or the UI is running with elevated privileges.