Skip to content
OpenAdvisories

Package · Go

github.com/0xJacky/Nginx-UI

41 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Critical 9.4
    CVE-2026-107806 Public exploit

    Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite

    Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The resto…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.0
    CVE-2026-42238

    Unauthenticated Remote Code Execution via Backup Restore in nginx-ui

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint (POST /api/restore) that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. A…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.4
    CVE-2026-33026

    nginx-ui Backup Restore Allows Tampering with Encrypted Backups

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.4, the nginx-ui backup restore mechanism allows attackers to tamper with encrypted backup archives and inject malicious configuration during restoration. This issue has been patch…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.8
    CVE-2026-33032 Public exploit Scanner template EPSS 35%

    Nginx UI: Unauthenticated MCP Endpoint Allows Remote Nginx Takeover

    Nginx UI is a web user interface for the Nginx web server. In versions 2.3.5 and prior, the nginx-ui MCP (Model Context Protocol) integration exposes two HTTP endpoints: /mcp and /mcp_message. While /mcp requires both IP whitelisting and authentication (AuthR…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.8
    CVE-2026-27944 Public exploit Scanner template EPSS 23%

    Nginx UI: Unauthenticated Backup Download with Encryption Key Disclosure

    Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This al…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go
  • Critical 9.8
    CVE-2024-23827

    Nginx-UI arbitrary file write through the Import Certificate feature

    Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the sys…

    0xJacky nginx-ui github.com/0xJacky/Nginx-UI Go