Nginx UI EUVD-2026-95894

Exploitation requires an authenticated Nginx UI account (PR:L) that holds permission to create AND restore backups - the attacker must be able to supply a crafted backup archive and invoke the restore operation. The specific precondition is use of the internal/backup/restore.go restore path in versions 2.0.0 through 2.4.x, which extracts inner archives and creates symlinks before enforcing the restore_nginx and restore_nginx_ui flags; the attack succeeds even when both flags are false. Limiting factors: this is not remote-unauthenticated (a valid backup-capable login is mandatory), impact lands only after the tampered configuration files are later consumed by Nginx, and upgrading to 2.5.0 fully remediates. No special non-default Nginx UI configuration beyond the standard backup/restore feature is needed.

This is a credible, above-average-priority issue but not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, base 8.1 HIGH) is internally consistent with the description: the backup/restore workflow is reachable over the network through the Nginx UI web interface (AV:N), requires no victim interaction (UI:N), and demands only a low-privilege authenticated account that can create and restore backups (PR:L). The confidentiality impact is correctly N (the flaw writes files rather than reading them), while integrity (persistent config injection) and availability (DoS when malformed files are consumed by Nginx) are both High. There is NO CISA KEV listing and NO public exploit code referenced in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - EPSS was not supplied and cannot be cited. No SSVC decision data was provided. The key limiting factor is the PR:L prerequisite: an attacker must already hold a valid Nginx UI account with backup privileges, which substantially narrows the realistic threat to malicious or compromised internal users rather than anonymous internet-wide scanning. Signals are not conflicting - the moderately high CVSS is driven by the I:H/A:H combination and offset in practice by the authentication requirement and the absence of any exploitation evidence.

An authenticated Nginx UI user with backup/restore permissions crafts a malicious backup archive whose inner tree contains a symlink pointing at the live Nginx configuration path, then restores it; because symlinks are created before the restore_nginx/restore_nginx_ui flags are enforced, a subsequent regular-file write follows the link and overwrites the real config even with both restore flags set to false. No public exploit code was identified in the provided data, but the fix commit (a467ed6) and advisory confirm the mechanism.