https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T16:27:23.099148+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-107806 fkie_cve-2026-107806 2026-10-10T16:27:23.111254+00:00

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

 https://vulnerability.circl.lu/vuln/ghsa-p393-cf76-4jmr GHSA-p393-cf76-4jmr — Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite 2026-10-10T16:27:23.111331+00:00

Affected: Go: github.com/0xJacky/Nginx-UI

## Summary

An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`.

This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`.

## Impact

An authenticated user can overwrite nginx-ui application configuration and database state through restore, including protected settings that are normally not writable through the settings API. By setting nginx command fields in the restored `app.ini`, the attacker can execute commands in the nginx-ui runtime context. This affects confidentiality, integrity, and availability because the attacker can read or replace secrets, change node/JWT secrets, corrupt application state, and execute arbitrary commands.

## Affected Version / Environment

- Version: `nginx-ui 2.3.11 2(523) 6c86e5a5` - Deployment: local Docker, `uozi/nginx-ui:latest` - Base URL used in validation: `http://127.0.0.1:8080`

## Root Cause

`/api/restore` is reachable through normal authenticated-user authorization. The restore handler accepts attacker-supplied backup key material, validates the manifest with a key derived from that supplied AES key, decrypts attacker-controlled backup contents, and copies restored `app.ini` into the live nginx-ui config path.

Relevant code paths:

- `api/backup/router.go`: `POST /api/restore` - `api/backup/restore…