{"id":"EUVD-2026-95897","enisaUuid":"23c94b53-7863-35d4-9ce9-a0ae69b43323","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:41:04 PM","dateUpdated":"Oct 9, 2026, 7:07:43 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2\nhttps://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","aliases":"CVE-2026-107812\nGHSA-662p-52hx-cmh2\n","assigner":"GitHub_M","epss":0.18,"enisaIdProduct":[{"id":"7f44b320-a34f-3553-8030-211eb452b834","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"enisaIdVendor":[{"id":"41ccc693-e889-3318-91ca-cae27c9f012d","vendor":{"name":"0xJacky"}}],"enisaIdVulnerability":[{"id":"45d5b77e-2022-379b-806a-a39af47b04ae","vulnerability":{"id":"GHSA-662p-52hx-cmh2","description":"Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM","datePublished":"Oct 9, 2026, 5:08:21 PM","dateUpdated":"Oct 9, 2026, 5:08:21 PM","baseScore":0.0,"references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2\nhttps://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec\nhttps://github.com/0xJacky/nginx-ui\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95897\n","aliases":"CVE-2026-107812\nGHSA-662p-52hx-cmh2\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:07:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f09e4ba2-3e84-3e00-a7db-d2dffbf3db41","vulnerability":{"id":"CVE-2026-107812","description":"Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.","datePublished":"Oct 9, 2026, 3:41:04 PM","dateUpdated":"Oct 9, 2026, 7:07:43 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","references":"https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2\nhttps://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec\nhttps://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0\n","enisa_id":"EUVD-2026-95897\n","assigner":"GitHub_M","epss":0.18,"dataProcessed":"Nov 1, 2026, 4:04:46 AM","vulnerabilityProduct":[{"id":"421b608d-9a34-3886-82cf-04fa2af019b9","product":{"name":"nginx-ui","vendor":{"name":"0xJacky"}},"product_version":"2.0.0, \u003c 2.5.0"}],"vulnerabilityVendor":[{"id":"f06571e5-3c0f-338f-a193-17d216f8bcda","vendor":{"name":"0xJacky"}}]}}],"enisaIdAdvisory":[]}