Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite — GHSA-P393-CF76-4JMR

Summary

## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ## Impact An authenticated user can overwrite nginx-ui application…

Timeline

Published by source

2026-10-09

Risk context

• Reported severity or threat level: critical.
• Reported CVSS score: 9 out of 10.
• Review exposure for the affected product or family: go: github.com/0xJacky/Nginx-UI.

Product

go: github.com/0xJacky/Nginx-UI

What to do

General, cautious steps (verify details in the official source):

• Prioritize patching or mitigation immediately (treat as actively risky).
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Evidence and provenance

Canonical advisory ID

GHSA-P393-CF76-4JMR

Source

GitHub

Vendor

GitHub

Published by source

2026-10-09

Last source activity

2026-10-09

Additional identifiers

CVE-2026-107806

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.