Nginx UI CVE-2026-107806

Exploitation requires an authenticated Nginx UI administrator with an active secure session (PR:H) - this is not remotely reachable by anonymous users. The specific prerequisite is access to the backup restore feature: the attacker submits attacker-controlled portable backup key material plus a matching manifest to POST /api/restore, which trusts the supplied key and overwrites the live app.ini (notably the protected TestConfigCmd setting). Execution is then triggered via POST /api/nginx/test. Limiting factors: the admin privilege requirement is the primary constraint; affected only on versions 2.3.8 through 2.4.x (fixed in 2.5.0); no end-user interaction is required beyond the attacker's own authenticated requests (UI:N). Instances not exposing an admin account to untrusted parties, or already upgraded to 2.5.0, are not exploitable.

This is a post-authentication code injection (CWE-94) leading to RCE in Nginx UI. The CVSS 4.0 score of 9.4 is Critical, but the vector itself is the key moderating signal: AV:N/AC:L/AT:N but PR:H means the attacker must already hold an authenticated administrator session before any exploitation is possible. This is confirmed by the description ('an authenticated administrator with an active secure session'). The high VC/VI/VA plus subsequent-system SC/SI/SA:H reflect that successful exploitation yields full command execution in the Nginx UI runtime context. No EPSS score, no CISA KEV listing, and no public POC were provided in the input - only the vendor patch commit and advisory. There is therefore no public exploit identified at time of analysis, and no evidence of active exploitation. Net assessment: the raw 9.4 overstates real-world urgency because exploitation requires pre-existing admin privileges; the realistic threat is privilege-consolidation / defense-in-depth (a malicious or compromised admin account, or a hijacked admin session, escalating from app-admin to OS-level command execution). Prioritize patching for internet-exposed instances, but this is not a mass-exploitable unauthenticated flaw. Note the PR:H dependency is confirmed by the CVSS vector and the description - these signals agree, so authentication requirement is not in doubt.

An attacker who has obtained an authenticated Nginx UI administrator session (via credential theft, session hijacking, or insider access) submits a crafted portable backup - supplying their own key material and a matching manifest - to POST /api/restore. The restore flow trusts the attacker-supplied key, decrypts the attacker-controlled payload, and overwrites app.ini including the protected TestConfigCmd setting; the attacker then calls POST /api/nginx/test, causing their injected command to execute in the Nginx UI runtime context. No public POC was provided, but the fixing commit (a467ed6) is published and reveals the trust-level mechanics.