CVE-2026-84320

## Summary Nginx UI validates `backup_path` and `storage_path` against the administrator-defined `backup.GrantedAccessPath` boundary, but the final auto-backup output filename is built from the user-controlled auto-backup `name` without stripping path separators or `..` components. An authenticated user who can create or modify an auto-backup task can set a name such as `task/../../../escaped`. The configured `storage_path` still passes validation because it is inside `GrantedAccessPath`, but the generated backup path escapes that storage directory when `filepath.Join(storage_path, filename)` resolves the embedded traversal sequence. This bypasses the documented backup path boundary and allows backup archives, and for encrypted configuration backups the adjacent `.key` file, to be written outside the intended storage directory with the Nginx UI process privileges. ## Affected Versions - Current `dev` branch commit checked: `4948fba8744e82c3d7003f68ee164e9f49421066` - Latest release checked: `v2.3.10`, published 2026-04-28 - The vulnerable filename construction is present in both current `dev` and `v2.3.10`. ## Security Boundary The project documentation describes `backup.GrantedAccessPath` as the critical security boundary for backup operations. It says the setting: - restricts backup operations to explicitly authorized directories, - prevents unauthorized access to sensitive system directories, - enforces administrator-defined boundaries, - normalizes paths to prevent traversal attempts. That boundary is enforced for the configured `storage_path`, but not for the final path after the backup name is appended. ## Root Cause `model.AutoBackup.GetName()` only trims whitespace and replaces spaces: ```go func (a *AutoBackup) GetName() string { return strings.ReplaceAll(strings.TrimSpace(a.Name), " ", "_") } ``` The result is then embedded directly into filenames: ```go filename := fmt.Sprintf("%s_%d.zip", autoBackup.GetName(), time.Now().Unix()) outputP