Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-107812 · Microsoft / collected KEV context

EUVD-2026-95897

GHSA-662p-52hx-cmh2

GO-2026-6705

cve-program · CVE-2026-107812

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2
• https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

euvd · EUVD-2026-95897

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2
• https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

nvd · CVE-2026-107812

• https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0
• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2

osv · GHSA-662p-52hx-cmh2

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2
• https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec
• https://github.com/0xJacky/nginx-ui
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

osv · GO-2026-6705

• https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2
• https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec
• https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0

No related operational record is retained in the current change model.