CVE-2026-107806

Description officielle (NVD)

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

Preuves de concept publiques (1)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

• murrez/CVE-2026-107806 · ★ 6 · 10/10/2026
  CVE-2026-107806 — nginx-ui 2.3.8–2.4.x auth RCE via forged backup restore (TestConfigCmd). PoCbit PoC: GET /api/backup, tamper app.ini, POST /api/restore, POST /api/nginx/test. check/exploit, batch ur

Références

• https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7 — Patch
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 — Release Notes
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr — Exploit, Vendor Advisory
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr — Exploit, Vendor Advisory

En bref

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS : probabilité estimée d'exploitation dans les 30 prochains jours.

Produits concernés

Sources officielles

Besoin d'aide ?

Nos experts évaluent votre exposition et vous accompagnent dans la correction.