Is CVE-2026-107806 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107806 being exploited in the wild.

How severe is CVE-2026-107806?

Critical severity, with a CVSS score of 4, published 9 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591, SEMVER:introduced=1.9.10-0.20260421071512-7864e378f5cf,fixed=1.9.10-0.20260728074146-a467ed652591; Uozi Nginx UI 2.3.11 and likely other versions.

How is CVE-2026-107806 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107806?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Uozi Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107806: Nginx UI authenticated remote code execution via backup restore

Q: Is there a fix for CVE-2026-107806?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later. Until then: Restrict the /api/restore endpoint to administrative users only, bind backup manifest signatures to server-side secrets rather than user-supplied key material, and block or sanitize protected application settings (nginx command fields) from being restored without explicit administrative approval. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107806 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107806?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Uozi Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107806 · Severity: critical · CVSS 4 · Published 2026-10-09

Nginx UI is a web interface for managing nginx web server configurations. An authenticated attacker can upload a forged backup file to restore malicious application settings, including nginx command options that allow arbitrary command execution with the privileges of the nginx-ui process.

Technologies: github.com/0xJacky/Nginx-UI (Go), Uozi Nginx UI. Vendors: Go, Uozi.

Quick answers

Is CVE-2026-107806 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107806 being exploited in the wild.
How severe is CVE-2026-107806?: Critical severity, with a CVSS score of 4, published 9 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20260421071512-7864e378f5cf, < 1.9.10-0.20260728074146-a467ed652591, SEMVER:introduced=1.9.10-0.20260421071512-7864e378f5cf,fixed=1.9.10-0.20260728074146-a467ed652591; Uozi Nginx UI 2.3.11 and likely other versions.
Is there a fix for CVE-2026-107806?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later. Until then: Restrict the /api/restore endpoint to administrative users only, bind backup manifest signatures to server-side secrets rather than user-supplied key material, and block or sanitize protected application settings (nginx command fields) from being restored without explicit administrative approval. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107806 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107806?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Uozi Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728074146-a467ed652591
```

Restrict the /api/restore endpoint to administrative users only, bind backup manifest signatures to server-side secrets rather than user-supplied key material, and block or sanitize protected application settings (nginx command fields) from being restored without explicit administrative approval.

Technical details

The /api/restore endpoint accepts user-supplied AES key material to decrypt and restore backup archives without requiring administrative privileges. An attacker can forge a backup by deriving the signing key from attacker-controlled key material, then restore a modified app.ini with malicious nginx command settings (TestConfigCmd) that execute shell commands when invoked via /api/nginx/test. The vulnerability requires an authenticated user session but does not validate that the backup originated from the server.

Affected products

uozi Nginx UI 2.3.11 and likely other versions

Identifiers

CVE-2026-107806
GHSA-p393-cf76-4jmr
GO-2026-6741

Timeline

2026-10-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.