Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM

Summary The self-upgrade downloads the release binary and its checksum .tar.gz and .tar.gz.digest through the SAME endpoint version.GetUrl, which is githubproxy or, by default, the project's cloud.nginxui.com mirror, and verifies the binary ONLY by comparing it to that digest: digestFileContent =...