What is CVE-2026-107810?

CVE-2026-107810 is a high-severity vulnerability in 0xjacky Nginx-Ui, classified under Improper Link Resolution Before File Access. CVSS score: 8.1/10. Published 2026-10-09.

How severe is CVE-2026-107810?

High severity. CVSS v3 base score is 8.1 out of 10.

Vulnerability in 0xjacky Nginx-Ui

CVE-2026-107810

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0.

Published 2026-10-09 · last modified 2026-10-09.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

0xjacky Nginx-Ui — versions >= 2.0.0, < 2.5.0

Weakness classification (CWE)

References

Frequently asked questions

What is CVE-2026-107810?: CVE-2026-107810 is a high-severity vulnerability in 0xjacky Nginx-Ui, classified under Improper Link Resolution Before File Access. CVSS score: 8.1/10. Published 2026-10-09.
How severe is CVE-2026-107810?: High severity. CVSS v3 base score is 8.1 out of 10.