CVE-2026-107806: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nginx UIto a version that resolves this vulnerability.Fixed in 2.5.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated Nginx UI administrator account with an active secure session. The attacker must be able to submit requests to the restore endpoint and then trigger the Nginx configuration test endpoint.
Which versions are affected and what version fixes it?
Nginx UI versions from 2.3.8 up to, but not including, 2.5.0 are affected. The issue is fixed in version 2.5.0.
What attacker-controlled inputs are needed to reach code execution?
The attacker supplies portable backup key material and a matching manifest to POST /api/restore. This allows attacker-controlled decrypted content to replace app.ini, including the TestConfigCmd setting, after which POST /api/nginx/test executes the restored command.