Nginx UI: Authenticated remote code execution via backup restore

Summary

Nginx UI, a web interface for managing the nginx web server, allows an authenticated administrator with an active secure session to restore a forged backup via POST /api/restore. The restore replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the attacker-defined command in the Nginx UI runtime context, which can affect confidentiality, integrity and availability. Exploitation requires administrator privileges; the NVD rating is 9.4 (CVSS 4.0, PR:H).

Affected

• nginx-ui 2.3.8 up to but not including 2.5.0
• Go module github.com/0xJacky/Nginx-UI: versions >= 2.3.8, < 2.5.0
• Docker images and binaries: exact build tags not confirmed; verify with the vendor

Fixed in

• Version 2.5.0 (fix commit a467ed652591fc0cd1b466a1ec751b493faef9f7)
• Version 2.5.1 is a hotfix that includes all 2.5.0 changes

Workaround

• None documented by the vendor. Unknown.
• Restrict access to the admin interface (VPN or IP allowlist) as an interim measure

Exploitation

• Public proof-of-concept exploit code exists (GitHub repository murrez/CVE-2026-107806).
• CISA SSVC: exploitation poc, automatable: no, technical impact: total.
• Not confirmed in CISA KEV; no in-the-wild exploitation reports found.
• EPSS 0.00571 at time of research.

Our recommendation

• Inventory all Nginx UI instances, including containers, and record their versions.
• Upgrade to 2.5.0 or later; 2.5.1 or newer is preferable.
• If an instance was exposed while vulnerable, review admin accounts, logs and backup/restore activity.
• Per the vendor, rotate the node secret, JWT secret and downstream credentials if a 2.3.6-or-earlier installation or such a backup was involved.
• Restrict admin access and enforce MFA or passkeys.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (1 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  murrez/CVE-2026-107806

Research sources

• GitHub Security Advisory GHSA-p393-cf76-4jmr github.com
• Nginx UI release v2.5.0 github.com
• Fix commit a467ed652591fc0cd1b466a1ec751b493faef9f7 github.com
• OSV entry CVE-2026-107806 osv.dev
• Nginx UI release v2.5.1 github.com
• GitLab advisory CVE-2026-107806 advisories.gitlab.com
• Public PoC repository murrez/CVE-2026-107806 github.com
• Vulners RAPID7 entry CVE-2026-107806 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 00:08.