Nginx-UI versions prior to 2.3.8 have a critical unauthenticated remote code execution vulnerability via the backup restore API endpoint. During the first 10 minutes after startup or any restart, the restore endpoint allows unauthenticated attackers to upload a crafted backup archive that overwrites configuration files, including app.ini. This enables injection of arbitrary OS commands via the TestConfigCmd setting, which are executed as the user running nginx-ui, often root in Docker environments. The vulnerability arises from a time-limited authentication bypass, lack of validation on restored files, and attacker-controlled cryptographic keys that bypass integrity checks. Frequent container restarts make the 10-minute unauthenticated window effectively persistent.