CVE-2026-42238: nginx-ui Authenticated RCE via Backup Restore App Config Overwrite

Vulnerability Overview Vulnerability Name: Authenticated Remote Code Execution via Backup Restore App Config Overwrite CVE ID: CVE-2026-42238 Severity: Critical (9.4 / 10) Release Date: August 12, 2024 Affected Versions: >= 2.3.8, < 2.5.0 Fixed Version: 2.5.0 Description: This vulnerability allows authenticated nginx-ui administrators to overwrite protected nginx command settings (such as ) by uploading a forged portable or encrypted backup file and restoring the . This leads to remote code execution. The vulnerability has been verified in nginx-ui versions 2.3.11 and 2.3.12. Differences: Unlike CVE-2026-42238, this vulnerability involves a post-authentication trust boundary failure. Attackers can overwrite protected nginx settings even without portable backup key material. Scope of Impact Affected Versions/Environments: Version: nginx-ui 2.3.11-2(523) 6c86e6a5 Deployment: Local Docker container Base URL: Impact: An attacker can overwrite the nginx-ui application configuration and database state, including settings that are typically unwritable. This may result in compromises to confidentiality, integrity, and availability. Attackers can read or replace secrets, change node/JWT secrets, corrupt application state, and execute arbitrary commands. Remediation Patch Guidance: Classify backups by trust level; verify backups using server-held keys and reject invalid signatures. Maintain portable AES recovery for all protected settings. Parse protected settings in , validate the complete staged restore path, and only replace the live file upon successful validation. POC Code

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-42238: nginx-ui Authenticated RCE via Backup Restore App Config Overwrite

More from this source