Patch Nginx UI 2.5.0: Backup Restore Flaw Lets Admins Run Arbitrary Code via Config Overwrite

Organisations running Nginx UI must update to version 2.5.0 immediately to mitigate a critical remote code execution vulnerability. The flaw, tracked as CVE-2026-107806, allows authenticated administrators to execute arbitrary code by manipulating the backup restoration process. This issue impacts confidentiality, integrity, and availability across affected deployments.

The risk

The vulnerability exists in the POST /api/restore endpoint of Nginx UI. According to the National Vulnerability Database, an attacker with an active secure session can submit attacker-controlled portable backup key material and a matching manifest. The application trusts the supplied key, decrypts the attacker-controlled contents, and replaces the live app.ini configuration file.

This process overwrites protected settings that are normally not writable through the standard settings API. The National Vulnerability Database notes that the restore flow includes nginx command settings such as TestConfigCmd. By modifying these settings in the restored configuration, an attacker can trigger command execution within the Nginx UI runtime context.

GitHub advisory GHSA-p393-cf76-4jmr confirms that the root cause lies in the restore handler accepting attacker-supplied backup key material. The handler validates the manifest with a key derived from that supplied AES key. This design allows the overwrite of application configuration and database state, including sensitive secrets like node or JWT secrets.

Who is exposed

Nginx UI versions from 2.3.8 up to 2.5.0 are affected by this vulnerability. The National Vulnerability Database lists the affected range as starting from version 2.3.8. The GitHub advisory specifically validated the exploit on Nginx UI version 2.3.11 running in a local Docker container.

The exploit requires an authenticated user with a valid JWT token. The GitHub advisory states that the /api/restore endpoint is reachable through normal authenticated-user authorization. Once authenticated, the user can upload a forged encrypted backup and trigger the restore.

After restoring the modified configuration, the attacker triggers command execution by calling POST /api/nginx/test. This executes the restored command in the Nginx UI runtime context. The GitHub advisory notes that this affects the ability to read or replace secrets and corrupt application state.

Cost and compliance

The Common Vulnerability Scoring System rates CVE-2026-107806 at 9.4, classifying it as critical. The weakness is associated with CWE-94, which covers code injection flaws. This high severity score reflects the full compromise of confidentiality, integrity, and availability.

Organisations must assess their exposure to this flaw. The vulnerability allows complete takeover of the Nginx UI instance. Compliance frameworks requiring strict configuration management and access controls may be violated if an attacker alters protected settings via the restore function.

Our take on the response

The vendor has released version 2.5.0 to fix this issue. The National Vulnerability Database confirms that the issue is fixed in this version. The GitHub advisory lists the patched version as 1.9.10-0.20260728074146-a467ed652591.

Managers should verify their current Nginx UI version immediately. If the version is below 2.5.0, update to the patched release. Review access logs for suspicious restore activities to detect potential exploitation.

What to do and how to stay safe: Nginx UI

• Verify your Nginx UI version and update to 2.5.0 or later if currently below that threshold.
• Review application logs for unexpected calls to the POST /api/restore endpoint by authenticated users.
• Restrict network access to the Nginx UI management interface to trusted administrative IP addresses only.
• Rotate sensitive secrets such as JWT tokens and node keys if you suspect the configuration file was compromised.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Nginx UI versions are affected by CVE-2026-107806?

Versions from 2.3.8 up to 2.5.0 are affected by this vulnerability.

Do attackers need to be authenticated to exploit this flaw?

Yes, an attacker must have an active secure session and valid credentials to use the restore API.

Is there a fix available for this vulnerability?

Yes, the vendor has released version 2.5.0 which fixes this issue.