{"id":"EUVD-2026-95822","enisaUuid":"a894874a-60db-3fb6-9730-5739c7a7a768","description":"Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:00:55 PM","dateUpdated":"Oct 14, 2026, 1:52:48 AM","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr\nhttps://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","aliases":"CVE-2026-107806\nGHSA-p393-cf76-4jmr\n","assigner":"GitHub_M","epss":0.57,"enisaIdProduct":[{"id":"b7a8aca7-1fa0-3789-a1af-c657330d6d4a","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.3.8, \u003c 2.5.0"}],"enisaIdVendor":[{"id":"e2b80f31-d45d-3c8d-a7f4-dec3551a75fa","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"5a831daf-3796-39ad-a3d3-f77597100345","vulnerability":{"id":"CVE-2026-107806","description":"Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:00:55 PM","dateUpdated":"Oct 14, 2026, 1:52:48 AM","status":"PUBLISHED","baseScore":9.4,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr\nhttps://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95822\n","assigner":"GitHub_M","epss":0.57,"dataProcessed":"Oct 29, 2026, 7:16:20 AM","vulnerabilityProduct":[{"id":"a2c79a2d-1eeb-3aa6-bf6f-b8807107bc4c","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.3.8, \u003c 2.5.0"}],"vulnerabilityVendor":[{"id":"0977e7f4-d6ce-3fa9-9e09-9b994810611b","vendor":{"name":"0xJacky"}}]}},{"id":"8eebeb2d-7090-39ed-b434-04d8bba8fe59","vulnerability":{"id":"GHSA-p393-cf76-4jmr","description":"Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite","datePublished":"Oct 9, 2026, 8:45:02 PM","dateUpdated":"Oct 9, 2026, 8:45:02 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-107806\nhttps://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95822\n","aliases":"GHSA-p393-cf76-4jmr\nCVE-2026-107806\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:02:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}