CVE-2026-42238

During the first 10 minutes after application startup, the POST /api/restore endpoint requires no authentication. An attacker sends a crafted backup archive that overwrites the app.ini configuration file and the SQLite database. Because the attacker controls the restored app.ini file, they can inject arbitrary system commands into the TestConfigCmd setting. After the application automatically restarts to load the restored configuration, a single subsequent request triggers execution of the injected command in the context of the user running nginx-ui — typically root in Docker environments.

An attacker can gain full control of the system by executing arbitrary OS commands with the privileges of the nginx-ui process (most commonly root), enabling compromise of both the application itself and the host system, as well as potentially adjacent environments (high impact on confidentiality, integrity, and availability in terms of the system and its surroundings).

Nginx UI should be updated to version 2.3.8 or later. The patch is available in the official repository: https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8. Until the update is applied, it is recommended to restrict network access to the Nginx UI administrative interface at the firewall level, especially during the first 10 minutes after each service startup or restart.

Nginx UI in versions earlier than 2.3.8, particularly fresh installations running in Docker containers.