Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Summary An authenticated nginx-ui user can call POST /api/restore, upload a forged encrypted backup, restore app.ini, set nginx command settings such as TestConfigCmd, and then trigger command execution with POST /api/nginx/test. This was validated on nginx-ui 2.3.11 2523 6c86e5a5 in the local...

CVE-2026-107806

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

CVE-2026-107806

The Nginx UI web user interface (versions 2.3.8 until 2.5.0 ) is vulnerable to Remote Code Execution due to an insecure backup restoration flow. An authenticated administrator with an active secure session can submit attacker-controlled backup key material and a manifest via POST /api/restore . T...

CVE-2026-107806 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key,...

Vulnerability of endpoints/api/restore and/api/users/admin/init of the Kubernetes management platform, allowing attackers to escalate their privileges

The vulnerability of the endpoints /api/restore and /api/users/admin/init of the Kubernetes management platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain increased privileges remotely...

CVE-2026-55761: Improper Authentication

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. In versions 2.39.0 through 2.39.3 and 2.40.0 until 2.43.0, unauthenticated restore and administrator initialization...

EUVD-2026-40158

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when adminapikey is empty, which is the default configuration. Remote attackers can exfiltrate the entire databas...

CVE-2026-56782: Missing Authentication for Critical Function

Gorse before 0.5.10 contains an authentication bypass vulnerability in the /api/dump and /api/restore endpoints that allows unauthenticated attackers to access protected functionality when adminapikey is empty, which is the default configuration. Remote attackers can exfiltrate the entire databas...

GHSA-4PVG-PRR3-9CXR Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore

Product: nginx-ui Repository: 0xJacky/nginx-ui branch: dev Vulnerability Class: Authentication Bypass → Arbitrary File Write → OS Command Injection Affected Component: POST /api/restore --- 1. Vulnerability Summary nginx-ui exposes a backup restore endpoint POST /api/restore that is completely...

CVE-2026-42238: Improper Control of Generation of Code

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...

CVE-2017-2890

An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability...

PT-2017-17633

Name of the Vulnerable Software and Affected Versions Unitrends Enterprise Backup versions prior to 9.1.1 Description An issue allows an authenticated attacker to read any file in the filesystem that the web server has access to. This is achieved through the "downloadFile" function in...

PT-2017-17634

Name of the Vulnerable Software and Affected Versions Unitrends Enterprise Backup versions prior to 9.1.2 Description The issue allows an authenticated user to execute arbitrary OS commands by sending a specially crafted filename to the "/api/restore/download-files" endpoint. This is related to t...