The nginx‑ui backup restore function, prior to version 2.3.4, allows an attacker who supplies a backup archive to modify the contents of an encrypted backup and inject malicious configuration directives. When the backup is restored, these directives become part of the nginx configuration, potentially granting unauthorized access or allowing arbitrary commands to run when nginx starts. This vulnerability involves improper handling of encrypted backup data and directly affects configuration integrity.

All installations of nginx‑ui with a version earlier than 2.3.4 are affected. No platform or operating system restriction is noted, so any host running the vulnerable web interface, regardless of its underlying OS, may be at risk. The vulnerability is specific to the 0xJacky nginx‑ui product and does not extend to other nginx components.

The flaw carries a CVSS score of 9.4, placing it in the critical range. Its EPSS score is below 1 %, indicating that automated exploitation attempts are currently unlikely. The vulnerability is not listed in the CISA KEV catalog. The most probable attack vector is via the web UI’s restore endpoint, requiring the attacker to be able to upload a crafted backup file; this infers that the attacker must have some level of interaction with the target system or the ability to deliver a malicious archive to a vulnerable instance.