An enclave of the Nginx UI application offers a backup restore endpoint that, for the first ten minutes after a fresh startup, is accessible without authentication. An attacker can upload a crafted archive that replaces the application's configuration file and its SQLite database, injecting an arbitrary operating system command through the TestConfigCmd setting. When the application restarts, the stored command executes as the nginx-ui process user, which, in containerised deployments, is typically root. The flaw is an instance of code injection, identified as CWE‑94, and yields uncontrolled code execution.

The vulnerability affects the 0xJacky nginx‑ui product released prior to version 2.3.8. Fresh installations with any version earlier than 2.3.8 are susceptible when the service is reachable during its initial ten‑minute window post‑startup.

The CVSS score is 9, indicating a high‑severity condition. The EPSS metric is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires remote network access to POST /api/restore during the unprotected window. Once the exploit succeeds, the attacker can run arbitrary commands as the service user, potentially leading to full system compromise when nginx‑ui runs with elevated permissions in Docker or as root on a host. The vulnerability is widely exploitable, even though it is time‑restricted, and should be regarded as a critical threat for exposed installations.