CVE-2026-107812
High
Description
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.
SeverityHigh
CVSS7.5
Exploit probability—
ProductNginxui Nginx Ui
PublishedOct 9, 2026
First seenOct 9, 2026
Weakness typeCWE-494CWE-494
How to fix
Update
- nginxui nginx_ui2.5.0 or later
- github.com/0xJacky/Nginx-UI1.9.10-0.20260728114330-580585516dd8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nginxui nginx_ui | 2.0.0 ≤ v < 2.5.0 | 2.5.0 |
| github.com/0xJacky/Nginx-UIGo | 1.9.10-0.20250517140552-daee3ac7ade1 ≤ v < 1.9.10-0.20260728114330-580585516dd8 | 1.9.10-0.20260728114330-580585516dd8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.