CVE-2026-107810

Name of the Vulnerable Software and Affected Versions Nginx UI versions 2.0.0 through 2.4.9

Description An authenticated user with permissions to create and restore backups can perform an arbitrary file write. The issue occurs because the internal/backup/restore.go file extracts inner archives before applying the restore nginx and restore nginx ui flags, allowing the use of symlinks that target the live Nginx configuration path. By crafting a malicious backup, an attacker can place a symlink in the staging tree and write a regular file through it, even if the restore flags are disabled. This can lead to persistent configuration injection or a denial of service when the modified files are processed.

Recommendations Update to version 2.5.0.