Ghostwire

CVE-2026-107806: Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

CRITICAL CVSS 0.0 Exploit Available 2 PoC

Published: October 9, 2026 | Last Modified: October 9, 2026

Description

Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

Ghostwire Analysis — What This Means Practically

2 proof-of-concept exploits available on GitHub. Public exploit code lowers the barrier for both researchers and attackers.

This analysis is generated by Ghostwire from NVD, CISA KEV, EPSS, and open-source intelligence data. Verify findings through primary sources before acting.

Proof-of-Concept Exploits (2)

0xJacky/nginx-ui
0xJacky/nginx-ui

Security Coverage (1 articles)

References

github.com/0xJacky/nginx-ui/security/advisories/GHSA-p393-cf76-4jmr
nvd.nist.gov/vuln/detail/CVE-2026-107806
github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7
github.com/0xJacky/nginx-ui/releases/tag/v2.5.0
github.com/advisories/GHSA-p393-cf76-4jmr
www.tenable.com/cve/CVE-2026-107806
www.cnnvd.org.cn/home/globalSearch?keyword=CVE-2026-107806