Is CVE-2026-107810 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107810 being exploited in the wild.

How severe is CVE-2026-107810?

High severity, with a CVSS score of 8.1, published 9 October 2026.

Which products and versions are affected?

github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074146-a467ed652591.

Is there a fix for CVE-2026-107810?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107810 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107810?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107810: Nginx UI backup restore follows crafted symlinks into live configuration

Q: Is there a fix for CVE-2026-107810?

Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-107810 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-107810?

Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107810 · Severity: high · CVSS 8.1 · Published 2026-10-09

Nginx UI is a web interface for managing Nginx web server configurations. An authenticated user can craft a malicious backup file that bypasses restore safety settings and injects arbitrary configuration files into the live Nginx configuration directory. This allows an attacker to modify how Nginx operates, potentially causing outages or redirecting traffic.

Technologies: github.com/0xJacky/Nginx-UI (Go), Nginx UI. Vendors: Go, Nginx UI.

Quick answers

Is CVE-2026-107810 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107810 being exploited in the wild.
How severe is CVE-2026-107810?: High severity, with a CVSS score of 8.1, published 9 October 2026.
Which products and versions are affected?: github.com/0xJacky/Nginx-UI (Go) >= 1.9.10-0.20250517140552-daee3ac7ade1, < 1.9.10-0.20260728074146-a467ed652591, SEMVER:introduced=1.9.10-0.20250517140552-daee3ac7ade1,fixed=1.9.10-0.20260728074146-a467ed652591.
Is there a fix for CVE-2026-107810?: Yes. github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107810 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107810?: Check whether you run github.com/0xJacky/Nginx-UI (Go) or Nginx UI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/0xJacky/Nginx-UI (Go): upgrade to 1.9.10-0.20260728074146-a467ed652591 or later
```
go get github.com/0xJacky/Nginx-UI@v1.9.10-0.20260728074146-a467ed652591
```

Technical details

A symlink-following vulnerability in the backup restore process allows extraction of files into the live Nginx configuration path even when restore flags are disabled. During archive extraction, the code allows symlinks targeting the Nginx configuration or modules directories, and then writes regular files by following those symlinks with os.OpenFile(), resulting in writes to the live path before security checks are applied. An authenticated attacker who can create and restore backups can exploit this to achieve persistent configuration injection.

Affected products

nginx-ui Nginx UI

Identifiers

CVE-2026-107810
GHSA-p8v3-89rh-jxc7
GO-2026-6707

Timeline

2026-10-09: disclosed: Vulnerability publicly disclosed on GitHub Advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.