{"url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/issues/5478","repository_url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager","labels_url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/issues/5478/labels{/name}","comments_url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/issues/5478/comments","events_url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/issues/5478/events","html_url":"https://github.com/NginxProxyManager/nginx-proxy-manager/issues/5478","id":4250269669,"node_id":"I_kwDOBtnUP879Vffl","number":5478,"title":"RCE via Shell Injection in DNS Credentials (Nginx Proxy Manager) - CVE-2026-40519","user":{"login":"Yasha-ops","id":54901715,"node_id":"MDQ6VXNlcjU0OTAxNzE1","avatar_url":"https://avatars.githubusercontent.com/u/54901715?v=4","gravatar_id":"","url":"https://api.github.com/users/Yasha-ops","html_url":"https://github.com/Yasha-ops","followers_url":"https://api.github.com/users/Yasha-ops/followers","following_url":"https://api.github.com/users/Yasha-ops/following{/other_user}","gists_url":"https://api.github.com/users/Yasha-ops/gists{/gist_id}","starred_url":"https://api.github.com/users/Yasha-ops/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Yasha-ops/subscriptions","organizations_url":"https://api.github.com/users/Yasha-ops/orgs","repos_url":"https://api.github.com/users/Yasha-ops/repos","events_url":"https://api.github.com/users/Yasha-ops/events{/privacy}","received_events_url":"https://api.github.com/users/Yasha-ops/received_events","type":"User","user_view_type":"public","site_admin":false},"labels":[{"id":784290172,"node_id":"MDU6TGFiZWw3ODQyOTAxNzI=","url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/labels/bug","name":"bug","color":"ee0701","default":true,"description":null}],"state":"open","locked":false,"assignees":[],"milestone":null,"comments":6,"created_at":"2026-04-12T23:16:56Z","updated_at":"2026-07-27T03:01:03Z","closed_at":null,"assignee":null,"author_association":"CONTRIBUTOR","issue_field_values":[],"type":null,"active_lock_reason":null,"sub_issues_summary":{"total":0,"completed":0,"percent_completed":0},"issue_dependencies_summary":{"blocked_by":0,"total_blocked_by":0,"blocking":0,"total_blocking":0},"body":"## Summary\nNginx Proxy Manager is vulnerable to **authenticated remote code execution** due to a shell injection in `setupCertbotPlugins()` (`backend/setup.js`).\n\nThe user-controlled field `dns_provider_credentials` is interpolated into a shell command executed via `child_process.exec()` without proper escaping.\nAn attacker with `certificates:manage` permission can inject arbitrary commands, executed on backend restart (typically as `root` in Docker deployments).\n\n## Affected Versions\n```\nv2.9.14   v2.9.15   v2.9.16   v2.9.17   v2.9.18   v2.9.19   v2.9.20\nv2.9.21   v2.9.22\nv2.10.0   v2.10.1   v2.10.2   v2.10.3   v2.10.4\nv2.11.0   v2.11.1   v2.11.2   v2.11.3\nv2.12.0   v2.12.1   v2.12.2   v2.12.3   v2.12.4   v2.12.5   v2.12.6\nv2.13.0   v2.13.1   v2.13.2   v2.13.3   v2.13.4   v2.13.5   v2.13.6   v2.13.7\nv2.14.0   (latest, still vulnerable)\n```\n\n## Root Cause\nIncorrect escaping order:\n```javascript\nconst escapedCredentials = certificate.meta.dns_provider_credentials\n    .replaceAll(\"'\", \"\\\\'\")\n    .replaceAll(\"\\\\\", \"\\\\\\\\\");\n```\n\nBackslashes are escaped **after** single quotes, breaking the protection and allowing injection.\nExample input:\n```\nx' ; cmd ; #\n```\n\nResults in command execution:\n```bash\necho 'x\\\\' ; cmd ; #'\n```\n\n## Exploitation\n1. Store payload in `dns_provider_credentials` (DB or race condition)\n2. Restart backend\n3. Payload executes via `/bin/sh -c` inside `exec()`\n\nReliable in Docker since `/etc/letsencrypt/credentials/` is not persisted.\nExample payload:\n```\nfake' > /dev/null; CMD ; echo '\n```\n\n## Impact\n* Full RCE\n* Access to secrets, TLS keys, database\n* Service disruption and persistence\n\n## Fix\n```javascript\n.replaceAll(\"\\\\\", \"\\\\\\\\\")\n.replaceAll(\"'\", \"\\\\'\");\n```","closed_by":null,"reactions":{"url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/issues/5478/reactions","total_count":1,"+1":1,"-1":0,"laugh":0,"hooray":0,"confused":0,"heart":0,"rocket":0,"eyes":0},"timeline_url":"https://api.github.com/repos/NginxProxyManager/nginx-proxy-manager/issues/5478/timeline","performed_via_github_app":null,"state_reason":null,"pinned_comment":null}