Read the docs
TI-2026-30559 Aliases CVE-2026-42238GHSA-4pvg-prr3-9cxr

Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

Priority HIGH 74CWE-94Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.

Summary

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject an arbitrary OS command into the TestConfigCmd setting. After the application automatically restarts to apply the restored config, a single follow-up request triggers that command as the user running nginx-ui — typically root in Docker deployments. This issue has been patched in version 2.3.8.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00971 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed nginx-ui (0xJacky): 2.3.8github.com/0xJacky/nginx-ui (Go): 2.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0xJackynginx-uibefore 2.3.82.3.8Patch availableCNA
—github.com/0xJacky/nginx-ui (Go)before 2.3.82.3.8Patch availableGHSA-4pvg-prr3-9cxr
  • nginx-ui Vendor0xJacky Affected before 2.3.8 Fixed in 2.3.8 Patch available CNA
  • github.com/0xJacky/nginx-ui (Go) Vendor— Affected before 2.3.8 Fixed in 2.3.8 Patch available GHSA-4pvg-prr3-9cxr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*before 2.3.8Vulnerable0xJacky
  • cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:* Versions before 2.3.8 Vulnerable ·0xJacky

Remediation

  • Fix · CNA nginx-ui (0xJacky) Fixed in 2.3.8
  • Fix · GHSA-4pvg-prr3-9cxr github.com/0xJacky/nginx-ui (Go) Fixed in 2.3.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42238
  2. 2026-10-03 Alias added: GHSA-4pvg-prr3-9cxr

References

Exploit 1

Advisory 1

Other 2

  • TI-2026-25478 Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover CVSS 3.1CRITICAL 9.8
  • TI-2026-25472 nginx-ui Backup Restore Allows Tampering with Encrypted Backups CVSS 4.0CRITICAL 9.4
  • TI-2026-22288 Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-15821 Nginx-UI arbitrary file write through the Import Certificate feature CVSS 3.1CRITICAL 9.8
  • TI-2026-70057 Code injection in Nginx UI backup restore allows code execution CVSS 4.0CRITICAL 9.4
  • TI-2026-32056 Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services CVSS 3.1CRITICAL 9.9
See all 31 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences