CVE-2026-107812CWE-494

CVE-2026-107812

High · published October 9, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
6.6
In the wild
Unconfirmed
What it is

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.6th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2026-10-09T20:17Z
Affected products (1)
ProductVersionsFixed in
nginxui/nginx_ui≥ 2.0.0, < 2.5.02.5.0
References (4)
https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec · [email protected]https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 · [email protected]https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2 · [email protected]https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 11 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 09 OCT 15:41Z
    Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
    cvelistv5
  • 09 OCT 15:41Z
    Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
    cvelistv5