CVE-2024-3736 is a medium severity vulnerability (CVSS 4.3) in cym1102 nginxWebUI. The upload function at /adminPage/main/upload accepts files without restricting them. The record names no fixed version. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- cym1102 nginxWebUI up to and including 3.9.9, according to the record.
Severity in the record: Medium, CVSS 4.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L. In plain terms: over the network, low privileges required, no user interaction. Weakness class: CWE-434, unrestricted upload of a file with a dangerous type.
Fixed version: The record names no fixed version. The project's GitHub issue 138 is listed in the references, so check it and the project releases for a newer build than 3.9.9.
The record says the exploit has been disclosed to the public and may be used. That is a statement from the disclosure, not a CISA Known Exploited Vulnerabilities listing, and the record's KEV flag is false.
How to check if you're exposed
- Find the version of the jar you run:
ls *.jarin the install directory, or check the container image tag if you deploy it in Docker. - Check whether the panel's port is reachable from outside: scan your own host from an outside network.
What to do now
- Apply the vendor fix when it is available.
- Restrict who can reach the upload feature, and remove it from internet exposure if you do not need it.
- Make sure the upload directory is not executable by the web server.
- Review recent uploads for files with unexpected types or extensions.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3736.
Why it matters
Upload handlers need to decide which file types are acceptable, where the file is stored, and whether the web server may execute it. When any of those checks is missing, an uploaded file can end up somewhere it should never be, or be handled as code. Good designs allow only the types they need, rename files on the server, and store them outside the web root.
An upload endpoint on an nginx management panel is sensitive because the panel manages the web server itself. Even a medium score deserves action if the panel faces the internet. The record says the exploit has been disclosed to the public. The project is a small open source panel, and this post found no confirmed maintainer fix.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Is nginxWebUI the same as nginx?
No. nginxWebUI is a separate web panel for managing nginx configuration. The CVE affects the panel, not nginx itself.
Is CVE-2024-3736 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
