CVE-2026-42238: CWE-94: Improper Control of Generation of Code ('Code Injection') in 0xJacky nginx-ui
CVE-2026-42238 is a critical code injection vulnerability in 0xJacky's nginx-ui prior to version 2.3.8. The vulnerability arises because the backup restore endpoint is unauthenticated for the first 10 minutes after startup on fresh installations. An attacker can exploit this by uploading a crafted backup archive that overwrites configuration files, allowing arbitrary OS command injection via the TestConfigCmd setting. This command executes with the privileges of the nginx-ui process user, often root in Docker deployments. The issue is patched in version 2.3.8.
AI Analysis
Technical Summary
The vulnerability in nginx-ui versions before 2.3.8 involves an unauthenticated backup restore endpoint accessible during the initial 10 minutes after process startup on fresh installs. An attacker can upload a malicious backup archive that overwrites the app.ini configuration file and SQLite database. By controlling the restored app.ini, the attacker injects arbitrary OS commands into the TestConfigCmd setting. When the application restarts to apply the restored configuration, a subsequent request triggers execution of the injected command with the privileges of the nginx-ui process user, typically root in Docker environments. This represents a critical code injection vulnerability (CWE-94) with a CVSS 4.0 base score of 9.0. The vulnerability has been fixed in nginx-ui version 2.3.8.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the nginx-ui process user, which is often root in Docker deployments. This can lead to full system compromise, unauthorized access, and control over the affected system. The vulnerability is critical due to the ease of exploitation (no authentication required during the initial window) and the high privileges of the executed commands.
Mitigation Recommendations
This vulnerability is fixed in nginx-ui version 2.3.8. Users should upgrade to version 2.3.8 or later to remediate this issue. Until upgrading, restricting access to the backup restore endpoint during the initial startup period or limiting the privileges of the nginx-ui process user may reduce risk, but the definitive remediation is to apply the official patch by upgrading.
CVE-2026-42238: CWE-94: Improper Control of Generation of Code ('Code Injection') in 0xJacky nginx-ui
Description
CVE-2026-42238 is a critical code injection vulnerability in 0xJacky's nginx-ui prior to version 2.3.8. The vulnerability arises because the backup restore endpoint is unauthenticated for the first 10 minutes after startup on fresh installations. An attacker can exploit this by uploading a crafted backup archive that overwrites configuration files, allowing arbitrary OS command injection via the TestConfigCmd setting. This command executes with the privileges of the nginx-ui process user, often root in Docker deployments. The issue is patched in version 2.3.8.
CVSS v4.0
Score 9.0critical
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in nginx-ui versions before 2.3.8 involves an unauthenticated backup restore endpoint accessible during the initial 10 minutes after process startup on fresh installs. An attacker can upload a malicious backup archive that overwrites the app.ini configuration file and SQLite database. By controlling the restored app.ini, the attacker injects arbitrary OS commands into the TestConfigCmd setting. When the application restarts to apply the restored configuration, a subsequent request triggers execution of the injected command with the privileges of the nginx-ui process user, typically root in Docker environments. This represents a critical code injection vulnerability (CWE-94) with a CVSS 4.0 base score of 9.0. The vulnerability has been fixed in nginx-ui version 2.3.8.
Potential Impact
Successful exploitation allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the nginx-ui process user, which is often root in Docker deployments. This can lead to full system compromise, unauthorized access, and control over the affected system. The vulnerability is critical due to the ease of exploitation (no authentication required during the initial window) and the high privileges of the executed commands.
Mitigation Recommendations
This vulnerability is fixed in nginx-ui version 2.3.8. Users should upgrade to version 2.3.8 or later to remediate this issue. Until upgrading, restricting access to the backup restore endpoint during the initial startup period or limiting the privileges of the nginx-ui process user may reduce risk, but the definitive remediation is to apply the official patch by upgrading.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-25T05:37:12.118Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69f90348cbff5d8610482e45
Added to database: 5/4/2026, 8:36:24 PM
Last enriched: 5/12/2026, 6:25:39 AM
Last updated: 6/18/2026, 6:48:02 AM
Views: 293
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.