CVE-2026-40519

Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions 2.9.14 through 2.15.1

Description An authenticated remote code execution issue exists via OS command injection in the setupCertbotPlugins() function located in backend/setup.js. Attackers with certificates:manage permissions can execute arbitrary commands by storing a malicious payload in the dns provider credentials field. This occurs because the user-controlled dns provider credentials value is interpolated directly into a shell command executed via child process.exec() without proper sanitization or escaping, leading to command execution upon backend restart. Real-world offensive activities targeting this issue have been identified.

Recommendations Update Nginx Proxy Manager to a version that includes commit a5db5ed. Restrict access to the dns provider credentials field to minimize the risk of exploitation.