Skip to content
Threat Feed
Subscribe

Vendor

Nginx-UI

4 briefs RSS
critical threat

Authenticated Remote Code Execution in Nginx-UI via Backup Restoration

An authenticated user can achieve remote code execution in Nginx-UI by uploading a maliciously crafted backup file that overwrites application configuration settings.

exploited Nginx-UI +4 remote-code-execution cve-2026-107806 vulnerability authentication-bypass cve-2026-107808 web-application n8n csrf +8
2r 4t 1c updated
high advisory

nginx-ui: Multiple Vulnerabilities

Multiple vulnerabilities in nginx-ui allow an attacker to execute arbitrary code, including with root privileges, gain elevated privileges, perform account takeover, bypass security measures, and disclose or manipulate data.

nginx-ui vulnerability rce privilege-escalation data-exfiltration
4t
critical advisory

Nginx-UI Unauthenticated Bootstrap Takeover

Nginx-UI version 2.3.5 is vulnerable to an unauthenticated takeover via the `/api/install` endpoint during the initial setup window, allowing a remote attacker to claim administrative control of a fresh instance.

nginx-ui bootstrap-takeover unauthenticated-access initial-access
2r 1t 1i
critical advisory

nginx-ui Backup Restore Allows Tampering with Encrypted Backups

The nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration, potentially leading to arbitrary command execution.

nginx-ui backup-tampering vulnerability
3r 2t