Critical RCE in Nginx UI Allows Authenticated Admins to Execute Arbitrary Code

Researchers have disclosed a critical remote code execution vulnerability in Nginx UI, a web user interface for the Nginx web server. The flaw, identified as CVE-2026-107806, allows an attacker with authenticated administrative access to execute arbitrary commands on the host system. This issue affects all versions of Nginx UI from 2.3.8 up to, but not including, 2.5.0.

The vulnerability stems from improper validation during the application's backup restoration process. According to the National Vulnerability Database (NVD), an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to the POST /api/restore endpoint. The restore flow incorrectly trusts the supplied key, decrypts the attacker-controlled contents, and replaces the live app.ini configuration file.

This replacement includes protected nginx command settings, such as TestConfigCmd. By subsequently triggering POST /api/nginx/test, an attacker can execute the restored command within the Nginx UI runtime context. This action compromises the confidentiality, integrity, and availability of the affected system. The NVD has assigned a CVSS score of 9.4 to this issue, classifying it as Critical. The underlying weakness is categorized under CWE-94, which involves improper control of generation of code.

Context and Background

Nginx UI serves as a management interface for the widely used Nginx web server, allowing administrators to configure and manage server settings through a web browser. The introduction of a remote code execution flaw in this interface represents a significant risk to organizations relying on the tool for server management. The ability to modify configuration files like app.ini through a trusted administrative interface bypasses standard security controls, effectively granting an attacker control over the server environment.

The exploit chain relies on the trust established during the authentication process. Once an administrator logs in, the application assumes the integrity of subsequent actions. By manipulating the backup restoration feature, an attacker can inject malicious code that is treated as legitimate configuration data. This type of vulnerability highlights the risks associated with administrative tools that perform sensitive operations like file replacement and command execution without strict validation of input sources.

Who Is Affected

Organizations using Nginx UI versions 2.3.8 through 2.5.0 are affected by this vulnerability. Any environment where the web interface is accessible to authenticated users is potentially at risk. The flaw requires an attacker to have valid administrative credentials, which limits the attack surface to scenarios where credential theft or session hijacking has occurred. However, once access is gained, the impact is severe, allowing for full system compromise.

The vendor, 0xJacky, has addressed this issue in version 2.5.0. Systems running versions prior to 2.5.0 remain vulnerable until they are updated. Organizations should verify their current installation version and compare it against the affected range. The presence of this flaw underscores the importance of keeping management interfaces updated, even if they are not directly exposed to the public internet, as internal threat actors or compromised credentials can still be leveraged for exploitation.

What should you do?

Administrators should immediately check their Nginx UI installation version. If the version is 2.3.8 or higher but lower than 2.5.0, they should plan to upgrade to version 2.5.0 as soon as possible. In the interim, restrict access to the Nginx UI interface to trusted networks and enforce strong authentication mechanisms to reduce the risk of unauthorized administrative access. Monitor logs for unusual activity related to the backup restoration API endpoints.