Nginx UI RCE Vulnerability Disclosed With PoC Exploit Code

Critical authenticated remote code execution (CVE-2026-107806) was disclosed in Nginx UI (affecting >=2.3.8, <2.5.0): an attacker with administrative access can upload a crafted backup that overwrites application configuration and injects OS commands. A working proof-of-concept has been published; maintainers fixed the issue in version 2.5.0 and administrators are advised to apply the patch immediately.