CVE-2026-107806
Received Received - Intake

Authenticated RCE via Backup Restore in Nginx UI

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: GitHub, Inc.

Description
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-107806
EUVD
EUVD-2026-95822

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
0xJacky nginx-ui >= 2.3.8, < 2.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Nginx UI versions 2.3.8 to 2.5.0. An authenticated administrator with an active session can upload malicious backup key material and a matching manifest via POST /api/restore. The system decrypts and uses this attacker-controlled content to replace the live app.ini file, including sensitive Nginx command settings like TestConfigCmd. When POST /api/nginx/test is triggered, it executes the restored command within the Nginx UI runtime context, compromising confidentiality, integrity, and availability of the system.

Detection Guidance

Check Nginx UI version. If it is between 2.3.8 and 2.5.0, the system is vulnerable. Review logs for POST requests to /api/restore or /api/nginx/test, especially from administrator accounts.

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on the system running Nginx UI. This could lead to unauthorized access, data breaches, system compromise, or disruption of services. Attackers could steal sensitive data, modify system configurations, or cause denial-of-service conditions.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Upgrade Nginx UI to version 2.5.0 or later immediately. Revoke any suspicious administrator sessions and review restored app.ini files for unauthorized changes. Monitor for unusual command execution in Nginx UI runtime.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107806. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart