Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a same-origin digest obtained from the same upgrade mirror. A compromised mirror or network attacker able to alter both responses can supply a malicious executable and matching digest. An operator-triggered upgrade is required, and the application installs and runs the attacker-controlled code in the Nginx UI process context on the next upgrade. This issue is fixed in version 2.5.0.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec Patch
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2 Exploit, Vendor Advisory
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2 Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 3
- Cpes+1 CPE criteria (now 1)NVD modified 2026-10-20 14:48
- StatusUndergoing Analysis → AnalyzedNVD modified 2026-10-20 14:48
- First seenCVSS 7.5NVD modified 2026-10-09 20:17
Affected (CPE criteria) 1
cpe:2.3:a:nginxui:nginx_ui:*:*:*:*:*:*:*:*
References 4
- https://github.com/0xJacky/nginx-ui/commit/580585516dd87a8b176bcdac258db70c3b64b7ec Patch
- https://github.com/0xJacky/nginx-ui/releases/tag/v2.5.0 Release Notes
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2 Exploit, Vendor Advisory
- https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-662p-52hx-cmh2 Exploit, Vendor Advisory