Authenticated attackers can hijack Nginx UI configs via backup symlink flaw

Authenticated users with backup restoration privileges in Nginx UI can inject arbitrary files into the live Nginx configuration directory by exploiting a symlink traversal flaw. The vulnerability, tracked as CVE-2026-107810, carries a CVSS score of 8.1, rated as high severity by the National Vulnerability Database.

The issue exists in versions of Nginx UI from 2.0.0 up to, but not including, 2.5.0. According to the NVD record, the flaw stems from how the application handles backup restoration. The restore process extracts inner archives before evaluating the `restore_nginx` and `restore_nginx_ui` flags. This timing allows an attacker to place symlinks in the staging tree that point to the live Nginx configuration path. When the extractor processes subsequent regular file entries, it follows these symlinks and writes attacker-controlled data directly to the live configuration files, even if the user explicitly disabled the restore flags for Nginx and the UI.

Technical Details

The vulnerability was detailed in a GitHub advisory (GHSA-p8v3-89rh-jxc7). The advisory explains that the restore flow always extracts the outer archive, verifies the manifest, and decrypts the inner `nginx-ui.zip` and `nginx.zip` archives before deciding whether to apply the restoration flags. The zip extractor explicitly permits absolute symlinks if the target is under the paths returned by `nginx.GetConfPath()` or `nginx.GetModulesPath()`.

Later regular-file entries are created using `os.OpenFile()` on the symlinked path. Because the function follows the symlink, it writes into the live path rather than the staging directory. This breaks the restore trust boundary during the extraction phase. An attacker can craft a valid backup archive that causes the staging process to write files into the live Nginx configuration tree, potentially persistently injecting configuration or causing a denial of service when the modified files are consumed.

Affected Versions

The NVD record identifies the affected software as 0xJacky nginx-ui, specifically versions greater than or equal to 2.0.0 and less than 2.5.0. The GitHub advisory provides more granular versioning for the Go module `github.com/0xJacky/Nginx-UI`. It lists vulnerable versions as those greater than or equal to `1.9.10-0.20250517140552-daee3ac7ade1` and less than `1.9.10-0.20260728074146-a467ed652591`. The advisory confirms that version `1.9.10-0.20260728074146-a467ed652591` contains the patch.

The weaknesses associated with this vulnerability are identified as CWE-59 (Improper Link Resolution Before File Creation) and CWE-61 (URL Redirection to Untrusted Site). The researcher verified the issue locally in an isolated environment using a temporary package-level harness that exercised the real `Backup()` and `Restore()` implementations.

What should you do?

Administrators should verify if they are running an affected version of Nginx UI. If using a version prior to 2.5.0, they should upgrade to the patched version immediately. Organizations should review access controls for backup restoration features to ensure only trusted administrators have the necessary privileges. Monitoring file integrity on live Nginx configuration directories can help detect unauthorized changes resulting from this exploit.