CVE-2026-107810 in Nginx UI
Summary
by MITRE • 10/09/2026
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/09/2026
The vulnerability identified within Nginx UI versions ranging from 2.0.0 to 2.5.0 represents a critical path traversal and symlink following flaw that undermines the integrity of the underlying web server configuration. This issue stems specifically from the logic implemented in the internal backup and restore module, which is responsible for handling archive extraction during restoration processes. The core technical deficiency lies in how the application manages file system operations when processing these archives. Specifically, the software extracts inner archives without adequately validating or sanitizing symbolic links contained within them before applying configuration flags such as restore_nginx and restore_nginx_ui. This lack of strict validation allows an attacker to manipulate the extraction process by including symlinks that point directly to sensitive directories where Nginx stores its live configuration files, typically located in paths like etc/nginx/conf.d or similar system-specific locations depending on the deployment environment.
The operational impact of this vulnerability is severe because it enables persistent unauthorized modification of server configurations even when explicit restoration flags are disabled. An authenticated user with permissions to create and restore backups can craft a malicious backup archive containing a symbolic link that targets the live Nginx configuration directory. When this archive is processed, whether through an automated background task or manual intervention, the extraction routine follows the symlink and writes regular files directly into the production configuration path rather than isolating them in a staging area as intended by the security design. This bypasses the protective barriers provided by the restore flags, effectively rendering those controls useless against this specific attack vector. The consequence is that an attacker can inject arbitrary Nginx configuration directives or overwrite existing critical files, leading to potential remote code execution if malicious proxy_pass rules are added, complete denial of service through invalid configurations that prevent the server from starting, or data exfiltration via misconfigured log paths.
This vulnerability aligns with Common Weakness Enumeration CWE-59 Improper Link Resolution Before File Access and CWE-22 Path Traversal: '..' Sequence, as it exploits improper handling of symbolic links to access files outside the intended directory structure. In terms of the MITRE ATT&CK framework, this behavior corresponds to techniques involving file system discovery and configuration modification, specifically allowing an adversary to alter system settings for persistence or impact. The attack requires authentication, which places it within the scope of privilege escalation if a lower-privileged user can exploit this feature to gain higher-level control over the web server infrastructure. The ability to persistently inject configurations means that even after the initial exploitation is detected and the malicious backup removed, the damage remains until the Nginx configuration files are manually restored from a known good state or reconfigured by an administrator with sufficient privileges.
Mitigation strategies for this vulnerability primarily involve upgrading to version 2.5.0 or later where the issue has been resolved through improved validation of archive contents and stricter enforcement of extraction boundaries. For organizations unable to immediately patch, implementing strict file system permissions that prevent write access to Nginx configuration directories by the user account running the Nginx UI service can provide a compensating control. Additionally, auditing backup archives for symbolic links before processing them or configuring the underlying operating system to ignore symlinks during extraction operations via mount options like nosymfollow can reduce risk. It is also advisable to restrict the privileges of accounts that have access to the backup and restore functionality within Nginx UI, ensuring that only highly trusted administrators possess these rights. Regular monitoring of configuration file integrity using tools such as AIDE or Tripwire can help detect unauthorized changes resulting from this vulnerability before they cause significant operational disruption.