Vulnerability · Published Oct 9, 2026 · Assigned by GitHub_M
CVE-2026-107806Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Critical 9.4
In plain English
A critical-severity code injection in nginx-ui from 0xJacky. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20260728074146-a467ed652591 | GHSA-p393-cf76-4jmr |
| Go | github.com/0xJacky/Nginx-UI | 1.9.10-0.20260728074146-a467ed652591 | GO-2026-6741 |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr x_refsource_CONFIRM
- https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7 x_refsource_MISC
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 x_refsource_MISC