Key points
- The vulnerability affects Nginx UI versions 2.3.8 up to, but not including, 2.5.0.
- National Vulnerability Database rates the flaw as critical with a CVSS score of 9.4.
- The issue is resolved in the vendor's latest release, version 2.5.0.
A severe remote code execution flaw has been identified in Nginx UI, a web-based management interface for the Nginx web server. The vulnerability, tracked as CVE-2026-107806, allows authenticated administrators to execute arbitrary commands within the application’s runtime environment.
The National Vulnerability Database (NVD) has assigned the issue a CVSS score of 9.4, classifying it as critical. The flaw stems from how the application handles backup restoration requests. An attacker who has gained administrative access and established a secure session can submit malicious portable backup key material along with a matching manifest to the /api/restore endpoint.
The application’s restore function trusts the provided key, decrypts the attacker-controlled content, and overwrites the live app.ini configuration file. This process includes replacing protected settings such as TestConfigCmd. When the attacker subsequently triggers the /api/nginx/test endpoint, the system executes the injected command, compromising confidentiality, integrity, and availability.
Understanding the technical impact
Nginx UI is designed to simplify the management of Nginx servers through a graphical interface. However, this convenience introduces complex logic for handling configuration changes and backups. According to the NVD record, the core weakness is identified as CWE-94, which relates to code injection. The application fails to adequately validate the contents of the backup files before applying them to the live system.
By manipulating the backup restore flow, an adversary can inject malicious commands into the application’s configuration. The subsequent test command then acts as the trigger, executing these instructions in the context of the Nginx UI runtime. This effectively grants the attacker control over the server processes managed by the interface, potentially allowing further lateral movement or data exfiltration within the network.
Who is affected
The vulnerability impacts users running specific versions of the Nginx UI software developed by 0xJacky. Systems running version 2.3.8 through any version prior to 2.5.0 are susceptible to this attack. Organisations that have not yet updated their installation remain exposed to the risk of remote code execution by any user with administrative privileges.
Our take on the response
The vendor has addressed the vulnerability in version 2.5.0 of Nginx UI. This update patches the flaw in the backup restoration logic, preventing the execution of untrusted commands. Security teams should verify their current version and apply the patch immediately if they fall within the affected range. Monitoring administrative access logs for unusual backup or restore activities can also help detect potential exploitation attempts.
Background: Data exfiltration
Data exfiltration is the unauthorised transfer of sensitive information from a protected system to an external destination. Attackers use this technique to steal intellectual property, financial records or personal data. You can reduce risk by monitoring outbound traffic, enforcing least privilege access and maintaining a clear view of where your data resides.
Read the full guide: Data Exfiltration: How Attackers Steal Information and How to Stop It
What to do and how to stay safe: Nginx UI
- Check your current Nginx UI version and upgrade to 2.5.0 or later if you are running a vulnerable release.
- Review access logs for the /api/restore and /api/nginx/test endpoints to identify any unauthorised or suspicious activity.
- Restrict administrative access to Nginx UI to trusted personnel only, ensuring strong authentication mechanisms are in place.
- Monitor system behaviour for unexpected command executions or configuration changes following any backup operations.
Step-by-step guide: Out-of-Band Patches: How Emergency Updates Prevent Downtime
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-107806?
The NVD has rated the vulnerability as critical with a CVSS score of 9.4.
Which versions of Nginx UI are vulnerable to this flaw?
Versions 2.3.8 up to, but not including, 2.5.0 are affected by this remote code execution vulnerability.
Is there a fix available for this vulnerability?
Yes, the issue has been fixed in version 2.5.0 of Nginx UI.