CVE-2026-107806github.com/0xJacky/Nginx-UI Code Injection
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Published Oct 9, 2026 · Updated Oct 15, 2026 · Also known as EUVD-2026-95822, GHSA-p393-cf76-4jmr
Key Facts
Patch immediately- CVE-2026-107806 is a critical-severity vulnerability (CVSS 9.4 v4) affecting github.com/0xJacky/Nginx-UI (go), nginx-ui.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 0.3% probability of exploitation in the next 30 days.
- Fixed versions are available, including github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591, nginx-ui 2.5.0.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v4
9.4
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS (30-day exploit likelihood)
0.3%
Higher than 25.0% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
43/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
1
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd.
Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.
Affected Products
3 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/0xJacky/Nginx-UIgo | >= 1.9.10-0.20260421071512-7864e378f5cf | 1.9.10-0.20260728074146-a467ed652591 |
| nginx-ui | >= 2.3.8,, >= >= 2.3.8, < 2.5.0 | 2.5.0 |
Patched Releases
github.com/0xJacky/Nginx-UI
1.9.10-0.20260728074146-a467ed652591
nginx-ui
2.5.0
Timeline
Publicly disclosed
Oct 9, 2026
Last updated
Oct 15, 2026
Weakness Type
- CWE-94 Improper Control of Generation of Code ('Code Injection')
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-107806
- advisoryGHSA advisory
- othergithub.com · nginx-ui
- otherhttps://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7
FAQ
Common Questions.
Nginx UI is a web user interface for the Nginx web server.
Affected: github.com/0xJacky/Nginx-UI (go) versions >= 1.9.10-0.20260421071512-7864e378f5cf; nginx-ui versions >= 2.3.8,, >= >= 2.3.8, < 2.5.0. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including github.com/0xJacky/Nginx-UI 1.9.10-0.20260728074146-a467ed652591, nginx-ui 2.5.0.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-107806 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo