GO-2026-6707

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied in github.com/0xJacky/Nginx-UI

At a glance

Published: 2026-10-19 21:08 UTC
Updated: 2026-10-19 21:31 UTC
CVE: CVE-2026-107810
Aliases: GHSA-p8v3-89rh-jxc7

Description

Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied in github.com/0xJacky/Nginx-UI

Affected packages

Package	Versions
Go · github.com/0xJacky/Nginx-UI	introduced 1.9.10-0.20250517140552-daee3ac7ade1, fixed 1.9.10-0.20260728074146-a467ed652591

References

https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-p8v3-89rh-jxc7 ADVISORY
https://github.com/0xJacky/nginx-ui/commit/a467ed652591fc0cd1b466a1ec751b493faef9f7 WEB
https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database