Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Advisories.Gitlab • October 10, 2026

An authenticated nginx-ui user can call POST /api/restore , upload a forged encrypted backup, restore app.ini , set nginx command settings such as TestConfigCmd , and then trigger command execution with POST /api/nginx/test .

This was validated on nginx-ui 2.3.11 2(523) 6c86e5a5 in the local Docker container uozi/nginx-ui:latest .

github.com /0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7

github.com /0xJacky/nginx-ui/releases/tag/v2.5.0

github.com /0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr

github.com /advisories/GHSA-p393-cf76-4jmr

nvd.nist.gov /vuln/detail/CVE-2026-107806

Code Behaviors & Features

Detect and mitigate CVE-2026-107806 with GitLab Dependency Scanning

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RCE Vulnerability in Nginx UI Disclosed A remote code execution vulnerability (CVE-2026-107806) has been identified in Nginx UI, affecting versions 2.3.11 through 2.4.x. Authenticated users can exploit this flaw by uploading a forged backup via the POST /api/restore endpoint, which allows them to overwrite sensitive application settings. This vulnerability was validated on nginx-ui 2.3.11 in a local Docker environment. The flaw enables attackers to execute arbitrary commands within the Nginx UI runtime context, impacting confidentiality, integrity, and availability. A fix was released in version 2.5.0 on October 9, 2026. The vulnerability has a CVSS score of 9.4, categorizing it as. Administrators are urged to update to the latest version to mitigate risks. 1 sources 78

Extracted Entities

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

Domains (1)

MITRE ATT&CK (1)

Platforms (1)

SHA1 Hashes (1)

Tools (2)