CVE-2026-107806 in Nginx UI
Summary
by MITRE • 10/09/2026
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified in Nginx UI versions ranging from 2.3.8 to 2.5.0 represents a critical server-side request forgery combined with insecure deserialization risks within the application's backup restoration mechanism. This flaw allows an authenticated administrator, who possesses an active secure session, to manipulate the system by submitting attacker-controlled portable backup key material along with a corresponding manifest via the POST /api/restore endpoint. The core technical deficiency lies in the restore flow's failure to validate the integrity and authenticity of the supplied encryption keys against trusted sources or internal state constraints. Instead, the application blindly trusts the provided key, proceeds to decrypt the payload using this unverified input, and subsequently overwrites critical configuration files such as app.ini without performing sufficient sanitization checks on the decrypted content.
The operational impact of this vulnerability is severe because it directly compromises the confidentiality, integrity, and availability of the Nginx web server infrastructure. By replacing protected nginx command settings in the application configuration file with attacker-controlled values, specifically targeting parameters like TestConfigCmd, an adversary can achieve remote code execution within the runtime context of the Nginx UI process. The exploitation chain is completed when a subsequent request triggers POST /api/nginx/test, which executes the maliciously injected command. This effectively grants the attacker full control over the underlying operating system commands executed by the web application service, leading to potential data exfiltration, complete system compromise, or denial of service through destructive command execution.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) and CWE-502 Deserialization of Untrusted Data due to the lack of integrity verification on decrypted content that influences executable behavior. In terms of adversary tactics, it maps to MITRE ATT&CK techniques involving Command and Scripting Interpreter execution via server-side request forgery or configuration manipulation. The attack vector requires authentication, classifying it as an authenticated insider threat or a compromised credential scenario under the broader category of privilege escalation through application logic flaws rather than traditional network-based injection attacks.
Mitigation strategies must prioritize immediate patching to version 2.5.0 where this issue has been resolved by implementing strict validation mechanisms for backup restoration processes. Administrators should enforce least-privilege principles, ensuring that service accounts do not possess unnecessary write access to critical configuration directories unless explicitly required and monitored. Additionally, input validation on the restore endpoint must be strengthened to verify that decrypted payloads match expected schema structures and do not contain unauthorized modifications to sensitive keys like TestConfigCmd. Implementing digital signature verification for backup manifests before decryption would further ensure data integrity and prevent the injection of malicious command parameters into the application runtime environment.