CVE-2026-40519
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk57th percentile - higher than 57% of all known CVEs
Summary
Nginx Proxy Manager versions 2.9.14 through 2.15.1 contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function. Attackers with certificates:manage permission can store a malicious payload in the dns_provider_credentials field, which is directly interpolated into a shell command without sanitization, leading to arbitrary command execution upon backend restart.
Risk Assessment
Risk includes full server compromise, loss of data confidentiality, integrity, and availability, and potential lateral movement within the network.
Recommendation
Immediately update to a version containing commit a5db5ed or later, and restrict certificates:manage permissions to trusted users only.
Other vulnerabilities in Nginx Proxy Manager
Original NVD description (English source)
Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command injection in the setupCertbotPlugins() function in backend/setup.js, allowing attackers with certificates:manage permission to execute arbitrary commands by storing a malicious payload in the dns_provider_credentials field. The user-controlled dns_provider_credentials value is interpolated directly into a shell command executed via child_process.exec() without sanitization or escaping, causing the injected command to execute upon backend restart.