CVE-2024-3737 is a medium severity vulnerability (CVSS 6.3) in cym1102 nginxWebUI. The function findCountByQuery behind /adminPage/www/addOver passes the dir argument to the file system without confinement. The record names no fixed version. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- cym1102 nginxWebUI up to and including 3.9.9, according to the record.
Severity in the record: Medium, CVSS 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: over the network, low privileges required, no user interaction. Weakness class: CWE-22, path traversal.
Fixed version: The record names no fixed version. The project's GitHub issue 138 is listed in the references, so check it and the project releases for a newer build than 3.9.9.
Source conflict: The disclosure text in the record calls this issue critical, while the CVSS base score of 6.3 rates it Medium. This post follows the score, and both views are stated here so you can judge it against your own exposure.
The record says the exploit has been disclosed to the public and may be used. That is a statement from the disclosure, not a CISA Known Exploited Vulnerabilities listing, and the record's KEV flag is false.
How to check if you're exposed
- Find the version of the jar you run:
ls *.jarin the install directory, or check the container image tag if you deploy it in Docker. - Check whether the panel's port is reachable from outside: scan your own host from an outside network.
What to do now
- Upgrade to a fixed release when the project ships one.
- Limit access to the administration interface to trusted networks.
- Run the service under an account that can only read and write the directories it needs.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3737.
Why it matters
Path traversal is a failure to confine a user supplied file or directory name to the folder the application meant to expose. If the application does not normalize and check the path, a value can point somewhere else on the file system. The fix is to resolve the final path and confirm it sits inside an allowed base directory.
A directory argument that is not constrained lets requests wander the file system. Because the panel often runs with permissions to edit nginx configuration, the readable area can be wide. The record says the exploit has been disclosed to the public. The project is a small open source panel, and this post found no confirmed maintainer fix.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Quick check
Is nginxWebUI the same as nginx?
No. nginxWebUI is a separate web panel for managing nginx configuration. The CVE affects the panel, not nginx itself.
Is CVE-2024-3737 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
