PatchTheCVECVE-2023-23596: jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection
CVE-2023-23596 is a high-severity flaw (CVSS 8.8) affecting nginx proxy manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly passed to the exec command, potentially allowing an authenticated attacker to execute arbitrary commands on the system. NOTE: this is not part of any NGINX software shipped by F5.
Why this priority
- High severity
- EPSS top 3%: very likely to be exploited
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.8 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 15.2% (top 3%) |
| CISA exploited list | No |
| Weakness | CWE-78 |
| Published | 2023-01-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2023-23596?
nginx proxy manager: upgrade to newer than 2.9.19. Exact commands for each OS are on this page.
Is CVE-2023-23596 being exploited?
CVE-2023-23596 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2023-23596 affect?
CVE-2023-23596 affects nginx proxy manager. Severity is high (CVSS 8.8). jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. When creating an access list, the backend builds an htpasswd file with crafted username and/or password input that is concatenated without any validation, and is directly
How urgent is CVE-2023-23596?
Priority 65/100. High severity; EPSS top 3%: very likely to be exploited; Public exploit reference; On your watchlist
Software pages
nginx vulnerabilities · F5 BIG-IP vulnerabilities
Related CVEs
- CVE-2025-50579 MEDIUM 5.3 DOWNGRADE A CORS misconfiguration in Nginx Proxy Manager v2.12.3 allows unauthorized domains to access sensitive data, p
- CVE-2024-46257 MEDIUM 6.3 DOWNGRADE A Command injection vulnerability in requestLetsEncryptSslWithDnsChallenge in NginxProxyManager 2.11.3 allows
- CVE-2024-46256 CRITICAL 9.8 DOWNGRADE A Command injection vulnerability in requestLetsEncryptSsl in NginxProxyManager 2.11.3 allows an attacker to R
- CVE-2024-39935 HIGH 8.8 UPGRADE jc21 NGINX Proxy Manager before 2.11.3 allows backend/internal/certificate.js OS command injection by an authe
- CVE-2023-27224 CRITICAL 9.8 DOWNGRADE An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to