CVE-2026-42238
published 2026-05-04CVE-2026-42238: Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is…
PriorityP272critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.76%
50.8th percentile
Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (app.ini) and SQLite database. Because the attacker controls the restored app.ini, they can inject an arbitrary OS command into the TestConfigCmd setting. After the application automatically restarts to apply the restored config, a single follow-up request triggers that command as the user running nginx-ui — typically root in Docker deployments. This issue has been patched in version 2.3.8.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| 0xjacky | nginx-ui | < 2.3.8 | 2.3.8 |
| github.com | 0xjacky_nginx-ui | >= 0 < 2.3.8 | 2.3.8 |
| nginxui | nginx_ui | < 2.3.8 | 2.3.8 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.0CRITICALCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
ghsa·2026-05-06
CVE-2026-42238 [CRITICAL] CWE-94 Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
Nginx-UI is Vulnerable to Unauthenticated Remote Code Execution via Backup Restore
**Product:** nginx-ui
**Repository:** `0xJacky/nginx-ui` (branch: `dev`)
**Vulnerability Class:** Authentication Bypass → Arbitrary File Write → OS Command Injection
**Affected Component:** `POST /api/restore`
---
## 1. Vulnerability Summary
nginx-ui exposes a backup restore endpoint (`POST /api/restore`) that is **completely unauthenticated** during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can upload a crafted backup archive that overwrites the application's configuration file (`app.ini`) and SQLite database. Because the attacker controls the restored `app.ini`, they can inject an arbitrary OS command into the `TestConfigCmd` setting. After
VulDB
0xJacky nginx-ui up to 2.3.7 Backup /api/restore code injection (EUVD-2026-27141)
vuldb·2026-05-04·CVSS 9.0
CVE-2026-42238 [CRITICAL] 0xJacky nginx-ui up to 2.3.7 Backup /api/restore code injection (EUVD-2026-27141)
A vulnerability was found in 0xJacky nginx-ui up to 2.3.7 and classified as critical. This affects an unknown part of the file /api/restore of the component Backup Handler. Such manipulation leads to code injection.
This vulnerability is uniquely identified as CVE-2026-42238. The attack can be launched remotely. No exploit exists.
It is suggested to upgrade the affected component.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-04
Published