CVE-2024-3739 is a medium severity vulnerability (CVSS 6.3) in cym1102 nginxWebUI. The upload handler at /adminPage/main/upload mishandles the file parameter in a way that allows OS command injection. The record names no fixed version. Below you will find the affected versions, how to check your exposure, and a short list of steps to take now.
What's affected
- cym1102 nginxWebUI up to and including 3.9.9, according to the record.
Severity in the record: Medium, CVSS 6.3, vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. In plain terms: over the network, low privileges required, no user interaction. Weakness class: CWE-78, OS command injection.
Fixed version: The record names no fixed version. The project's GitHub issue 138 is listed in the references, so check it and the project releases for a newer build than 3.9.9.
Source conflict: The disclosure text in the record calls this issue critical, while the CVSS base score of 6.3 rates it Medium. This post follows the score, and both views are stated here so you can judge it against your own exposure.
The record says the exploit has been disclosed to the public and may be used. That is a statement from the disclosure, not a CISA Known Exploited Vulnerabilities listing, and the record's KEV flag is false.
How to check if you're exposed
- Find the version of the jar you run:
ls *.jarin the install directory, or check the container image tag if you deploy it in Docker. - Check whether the panel's port is reachable from outside: scan your own host from an outside network.
What to do now
- Install the vendor fix as soon as it is published.
- Restrict the management interface to a trusted network and require authentication in front of it.
- Run the service as an unprivileged user so a command that does run has limited reach.
- Watch process and audit logs on the host for commands the application does not normally start.
- Record the decision in your tracker with the CVE id and the date, so the next audit can see what you did about CVE-2024-3739.
Why it matters
Command injection occurs when an application passes user influenced text to a shell or to an external program without neutralizing special characters. The operating system then runs more than the developer intended. Safer designs avoid the shell, call programs with a fixed argument list, and validate every value against a strict allow list.
Command execution is the most serious outcome in this group. A management panel is often installed on the same host as the web server, so a command that runs there runs with the panel's privileges. The record says the exploit has been disclosed to the public. The project is a small open source panel, and this post found no confirmed maintainer fix.
Look up the entry on Gold to see how it connects to other advisories, and use reachability analysis to separate the components that actually call vulnerable code from the ones that merely sit in your inventory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is nginxWebUI the same as nginx?
No. nginxWebUI is a separate web panel for managing nginx configuration. The CVE affects the panel, not nginx itself.
Is CVE-2024-3739 in the CISA KEV catalog?
No. The record's KEV flag is false.
Sources
These links come from the NVD record. They were not retrievable when this post was written, so the details above rest on the record text. Check them before you act.
Last reviewed: 19 October 2026.
