CVE-2026-107806: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

October 9, 2026

An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test.

This was validated on nginx-ui 2.3.11 2(523) 6c86e5a5 in the local Docker container uozi/nginx-ui:latest.

References

github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7
github.com/0xJacky/nginx-ui/releases/tag/v2.5.0
github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr
github.com/advisories/GHSA-p393-cf76-4jmr
nvd.nist.gov/vuln/detail/CVE-2026-107806

Code Behaviors & Features

Detect and mitigate CVE-2026-107806 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →