CVE-2026-90581

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-90581

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90581.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-90581

Published

2026-09-13T19:30:09Z

Modified

2026-09-15T03:48:22Z

Severity

2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

Details

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

Database specific

{
    "cna_assigner": "VulDB",
    "cwe_ids": [
        "CWE-74",
        "CWE-94"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90581.json"
}

References

Affected packages

Git / github.com/cym1102/nginxwebui

Affected ranges

Type

GIT

Repo

https://github.com/cym1102/nginxwebui

Events

Introduced

e38a8534d99d315a569720d70c1e2616cc8214c6

Last Affected

9f10107f3cc0cff51e659e43a564a4a15c06408f

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "4.4.0"
        },
        {
            "last_affected": "4.4.0"
        },
        {
            "introduced": "4.4.1"
        },
        {
            "last_affected": "4.4.1"
        },
        {
            "introduced": "4.4.2"
        },
        {
            "last_affected": "4.4.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

4.*

4.3.8

4.3.9

4.4.0

4.4.1

4.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90581.json"