Vulnerability · Published Sep 13, 2026 · Assigned by VulDB

CVE-2026-90581cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

Medium 6.3

In plain English

A medium-severity code injection in nginxWebUI from cym1102. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)6.3Medium

Exploit odds (30 days)0.4%top 64.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Affected products (as reported)

Vendor	Product	Versions
cym1102	nginxWebUI	4.4.04.4.14.4.2

Weakness: CWE-94, CWE-74 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

References

VDB-403166 | cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection vdb-entry, technical-description
VDB-403166 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
CVE-2026-90581 | CVE Analysis and Report third-party-advisory
Submit #913328 | cym1102 nginxWebUI 4.4.2 Code Injection third-party-advisory
https://github.com/cym1102/nginxWebUI/issues/213 exploit, issue-tracking
https://github.com/cym1102/nginxWebUI/pull/215 issue-tracking, patch
https://github.com/cym1102/nginxWebUI/ product