CVE-2026-107806
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
- CVSS 4.0
- 9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-25)
- CWE
- CWE-94
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nginxui:nginx_ui
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p393-cf76-4jmr | Go | github.com/0xJacky/Nginx-UI | >=1.9.10-0.20260421071512-7864e378f5cf <1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |
| GO-2026-6741 | Go | github.com/0xJacky/Nginx-UI | >=1.9.10-0.20260421071512-7864e378f5cf <1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |