An authenticated user who creates or restores backups can embed a symbolic link in a backup archive that points to a path within the live Nginx configuration tree. During restore, the extraction routine follows the symlink before the restore flags that normally guard against file writes are applied, enabling the attacker to create or overwrite configuration files. This leads to persistent modification of the Nginx configuration, permitting malicious directives to be inserted or the service to be disrupted.

Versions 2.0.0 through 2.5.0 of the Nginx UI web interface are impacted. Any deployment that permits authenticated users to perform backup and restore operations is vulnerable.

The CVSS score of 8.1 classifies the flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to be authenticated to the UI and have the privilege to create backups; after crafting a backup containing a harmful symlink and restoring it, the attacker gains persistent control over the server configuration, which can enable further compromise or lead to denial of service.