{"id":"CVE-2026-107806","kind":"vulnerability","aliases":["CVE-2026-107806","GHSA-p393-cf76-4jmr","GO-2026-6741"],"related":[],"title":"Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI","description":"Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.","summary":"Nginx UI, a web interface for managing Nginx, lets an authenticated administrator restore a crafted backup that overwrites app.ini, including the nginx test command setting. Triggering the nginx config test then runs the attacker's command in the Nginx UI runtime context.","severity":"critical","cvss":9.4,"epss":0.00405,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/0xJacky/Nginx-UI","fixed":["1.9.10-0.20260728074146-a467ed652591"],"affected":">= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591","ecosystem":"go"}],"ecosystems":["go"],"tags":["go","nginx","nginx-ui","package","self-hosted"],"not_affected_if":["no-admin-access-exposed","versions-2.5.0-or-later","versions-before-2.3.8"],"how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; versions from 2.3.8 up to but not including 2.5.0 are affected.","fix":"Upgrade github.com/0xJacky/Nginx-UI to 2.5.0 or later (the fixed pseudo-version 1.9.10-0.20260728074146-a467ed652591 per govuln).\nRestrict access to the admin panel and review who holds admin accounts until patched.","status":"open","published_at":"2026-10-09T15:17:10+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T19:52:35+00:00","updated_at":"2026-10-23T19:52:35+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T19:52:35Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/0xJacky/Nginx-UI to 2.5.0 or later (the fixed pseudo-version 1.9.10-0.20260728074146-a467ed652591 per govuln).\nRestrict access to the admin panel and review who holds admin accounts until patched.","summary":"Nginx UI, a web interface for managing Nginx, lets an authenticated administrator restore a crafted backup that overwrites app.ini, including the nginx test command setting. Triggering the nginx config test then runs the attacker's command in the Nginx UI runtime context.","category":"package","who_cares":["nginx-ui","self-hosted","go","nginx"],"confidence":0.8,"analyst_note":"Sources list two version schemes (2.x in the description, 1.9.10 pseudo-versions in govuln); confirm the affected range at https://pkg.go.dev/vuln/GO-2026-6741 and the GHSA-p393-cf76-4jmr advisory.","how_to_check":"Check the Go module version of github.com/0xJacky/Nginx-UI in go.mod or the running binary; versions from 2.3.8 up to but not including 2.5.0 are affected.\nunknown","needs_analyst":true,"not_affected_if":["versions-before-2.3.8","versions-2.5.0-or-later","no-admin-access-exposed"],"severity_if_unknown":"critical"},"cost_usd":0.000474,"input_tokens":2330,"output_tokens":482,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-107806':19A,30A '-2026':18A,26A,29A '-6741':27A '/0xjacky/nginx-ui':16A,33A '/api/nginx/test':152C '/api/restore':124C '2.3.8':98C '2.5.0':100C,175C '4jmr':24A 'activ':106C 'administr':54B,103C 'affect':164C 'app':10A 'app.ini':61B,141C 'attack':76B,112C,134C 'attacker-control':111C,133C 'authent':3A,53B,102C 'avail':168C 'backup':8A,58B,115C 'cf76':23A 'code':5A 'command':66B,78B,145C,157C 'confidenti':165C 'config':11A,71B 'content':136C 'context':84B,163C 'control':113C,135C 'craft':57B 'cve':17A,28A 'decrypt':132C 'execut':6A,154C 'fix':172C 'flow':127C 'ghsa':21A 'ghsa-p393-cf76-4jmr':20A 'github.com':15A,32A 'github.com/0xjacky/nginx-ui':14A,31A 'go':25A,34B 'host':42B 'includ':62B,142C 'integr':166C 'interfac':47B,91C 'issu':170C 'key':116C,131C 'let':51B 'live':140C 'manag':49B 'manifest':121C 'match':120C 'materi':117C 'nginx':1A,35B,37B,43B,50B,64B,70B,81B,85C,94C,144C,160C 'nginx-ui':36B 'overwrit':12A,60B 'p393':22A 'packag':39B 'portabl':114C 'post':123C,151C 'protect':143C 'remot':4A 'replac':138C 'restor':9A,55B,126C,156C 'run':74B 'runtim':83B,162C 'secur':107C 'self':41B 'self-host':40B 'server':96C 'session':108C 'set':67B,146C 'submit':110C 'suppli':130C 'test':65B,72B 'testconfigcmd':149C 'trigger':68B,150C 'trust':128C 'ui':2A,38B,44B,82B,86C,161C 'user':90C 'version':174C 'via':7A 'web':46B,89C,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-09T15:17:10+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6741","url":"https://pkg.go.dev/vuln/GO-2026-6741","severity":null,"published_at":"2026-10-19T21:08:26+00:00","modified_at":"2026-10-19T21:08:26+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107806","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107806","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-107806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107806","severity":null,"published_at":"2026-10-09T15:17:10+00:00","modified_at":"2026-10-20T20:44:42+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}