CVE-2026-107806
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test.
- No known exploitation
- Severity
- Critical, CVSS 9.0 (v4.0)
- EPSS
- 0.41% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591, fixed in 1.9.10-0.20260728074146-a467ed652591 · GHSA-p393-cf76-4jmr