Nginx UI EUVD-2026-95897

Exploitation requires two concurrent conditions: (1) the attacker must control the Nginx UI upgrade mirror or hold a man-in-the-middle network position capable of altering BOTH the downloaded binary and its digest response (the same-origin digest provides no independent trust anchor); and (2) an operator must manually trigger the self-upgrade feature - the code is installed and run only on that next upgrade. Limiting factors: only the self-upgrade workflow is affected (default install without an operator-initiated upgrade is not exploitable), and the high network/mirror-position requirement plus required operator action substantially narrow realistic exploitation. Only versions 2.0.0 through 2.4.x are affected; 2.5.0 adds minisign signature verification.

This is a code-integrity flaw (CWE-494) in the Nginx UI self-upgrade mechanism, where a downloaded binary is validated only against a same-origin digest from the same mirror, so an attacker who controls that mirror or the network path can swap in both a malicious binary and a matching digest. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) accurately captures the shape: network-reachable and unauthenticated, but gated by high attack complexity (the attacker must already hold a privileged network/mirror position and tamper with two responses) and by required operator interaction (the upgrade must be manually triggered). No EPSS score, KEV listing, or POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the two preconditions (MITM-or-mirror-compromise plus an operator-initiated upgrade) make opportunistic mass exploitation unlikely and point toward targeted abuse if exploited at all. This is therefore a genuine full-compromise risk once the preconditions are met (attacker code runs in the Nginx UI process context, yielding C/I/A High), but the AC:H and UI:R gates place it below internet-facing drive-by criticals in real-world priority. Note the C:H rating: the flaw is tagged 'Information Disclosure' in the input, but the actual primary impact is arbitrary code execution / supply-chain integrity loss, so the tag understates and mischaracterizes the risk.

An attacker who has compromised the Nginx UI upgrade mirror, or who occupies a man-in-the-middle position on the network path (e.g. a hostile network or TLS-stripping proxy), waits for or induces an operator to click 'upgrade' in the Nginx UI (versions 2.0.0 to pre-2.5.0). The attacker returns a malicious executable together with a matching same-origin digest, which passes validation, and the application installs and executes the attacker's code in the Nginx UI process context on the next upgrade. No public exploit code was identified at time of analysis, and high attack complexity means the attacker must already hold the mirror/network position.