Critical CVE-2026-107806 in Nginx UI allows code execution via backup restore

Nginx UI versions 2.3.8 through 2.5.0 contain a CWE-94 flaw rated CVSS 4.0 9.4: when restoring a backup, the manifest.sig verification key is derived from the attacker-supplied AES key. An admin with a valid session can tamper with app.ini and execute commands on the host. Fixed in 2.5.0.

• CVSS 4.0 score 9.4 (Critical), CWE-94, requires a valid admin session
• Backup signature verification key is derived from the submitted AES key
• Tampering with app.ini lets an attacker run commands on the nginx host
• Fixed in version 2.5.0 (commit a467ed6)