PT-2026-35731 · Nginx-Ui · Nginx-Ui

Captain99Hook · Published 2026-04-21 · Updated 2026-05-13 · CVE-2026-42238

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions nginx-ui versions prior to 2.3.8

Description An authentication bypass exists in the backup restore functionality. During the first 10 minutes after a fresh installation or any process restart, the 'POST /api/restore' endpoint is completely unauthenticated. A remote attacker can exploit this window to upload a crafted backup archive that overwrites the application's configuration file app.ini and the SQLite database. By controlling the app.ini file, the attacker can inject arbitrary OS commands into the TestConfigCmd variable. Once the application restarts to apply the configuration, a subsequent request triggers the execution of the injected command with the privileges of the user running nginx-ui, which is typically root in Docker deployments.

Recommendations Update to version 2.3.8 or later. As a temporary workaround, restrict network access to the nginx-ui port (default 9000/tcp) to trusted IP addresses only to prevent unauthorized access to the restore endpoint.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2026-06314

CVE-2026-42238

GHSA-4PVG-PRR3-9CXR

Affected Products

Nginx-Ui

References · 19

• 🔥 https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-4pvg-prr3-9cxr · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42238 · Security Note
• https://bdu.fstec.ru/vul/2026-06314 · Security Note
• https://osv.dev/vulnerability/GHSA-4pvg-prr3-9cxr · Vendor Advisory
• https://github.com/0xJacky/nginx-ui · Note
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.3.8 · Note
• https://twitter.com/CVEnew/status/2051403812401725534 · Twitter Post
• https://twitter.com/UpwindMDR/status/2051546242287640685 · Twitter Post
• https://t.me/CVEtracker/52680 · Telegram Post
• https://mondoo.com/vulnerability-intelligence/vulnerability/CVE-2026-42238 · Note
• https://securityonline.info/nginx-ui-rce-vulnerability-cve-2026-42238-auth-bypass · Note
• https://t.me/cveNotify/162372 · Telegram Post
• https://twitter.com/autumn_good_35/status/2052391344581251498 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2049075708505575740 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051405492442787861 · Twitter Post