CVE-2026-107810 · GHSA-p8v3-89rh-jxc7
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
- Risk score
- 70/100
- CVSS
- 8.1 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 9 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups c…
- Affected
- github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591
- Fix
- Upgrade github.com/0xJacky/Nginx-UI to 1.9.10-0.20260728074146-a467ed652591 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
github.com/0xJacky/Nginx-UI: Amber, patch this week. Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore issued a session after password verification, despite Enabled2…
The flaws
- CVE-2026-107810: Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied (CVSS 8.1 · EPSS 0%)
- CVE-2026-107808: Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) (CVSS 8.1 · EPSS 0%)
- CVE-2026-107809: Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs (CVSS 8.8 · EPSS 0%)
- CVE-2026-107811: 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser (CVSS 8.8 · EPSS 0%)
The fix
Upgrade github.com/0xJacky/Nginx-UI: 2.5.0 or later on your release line
Who is exposed: github.com/0xJacky/Nginx-UI (go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074558-95cd21b70814
Where it stands
- Public proof of concept
Connects to
- Same weakness: CWE-59 (CWE-59). 78 other warnings in 30 days
- Same product: Earlier github.com/0xJacky/Nginx-UI warnings. 5 in the last 90 days
Why it is Amber
- CVSS 8.1 high
- Public exploit or proof of concept referenced
- On your watchlist: nginx, Go
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| github.com/0xJacky/Nginx-UI | go | >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591 | 1.9.10-0.20260728074146-a467ed652591 |
References
- https://github.com/advisories/GHSA-p8v3-89rh-jxc7
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p8v3-89rh-jxc7
- https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0
- https://github.com/advisories/GHSA-p8v3-89rh-jxc7
Original description
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.
Last activity 9 Oct 2026. Patch Forecast updates every hour.