nnn file manager CVE-2026-121549

Requires a local unprivileged account on the same host and the ability to write into /tmp (or $TMPDIR). The attacker must pre-create a symlink at the predictable target path before the victim acts: for pdfread this is the name-derived path '${TMPDIR:-/tmp}/<basename-without-extension>', and for nuke's listimages it is the PID-derived '${TMPDIR:-/tmp}/nuke_$$'. The victim must then actively invoke the pdfread or nuke plugin within nnn (UI:A) - for the name-derived case, typically on an attacker-influenced filename; for the PID-derived case, the attacker must also predict/guess the victim's process PID (reflected as AT:P). Limiting factors: no remote vector (local only), authenticated local access needed (PR:L), mandatory victim interaction, and impact bounded to files the victim can already write - so shared/multi-user systems are the realistic exposure, and single-user desktops are largely unaffected.

This is a genuinely low-to-moderate real-world risk, not a critical priority despite the CWE-377 class. The supplied CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:A, score 4.1) describes a local, privilege-requiring attack that also needs victim interaction (UI:A) and a non-guaranteed attack requirement (AT:P) - all of which sharply constrain exploitability. There is no KEV listing and no EPSS score in the input, so there is no evidence of active or widespread exploitation; exploitation status is 'no public exploit identified at time of analysis.' The vuln.today Decision label is 'this_month' (moderate urgency, not act_now/emergency), which is consistent with the low CVSS and the absence of exploitation signals. The only impact is integrity (VI:H): overwriting/truncating files the victim can already write, with no confidentiality (VC:N) or availability-of-system (VA:N) impact. One signal conflict to note: the input Tag 'Information Disclosure' contradicts the CVSS vector, which shows VC:N (no confidentiality impact) and VI:H - this is a file-overwrite/integrity flaw, not disclosure. Net: low priority for most defenders; patch within the normal cycle unless nnn is run by privileged users on shared multi-user hosts, where the integrity impact is more meaningful.

On a shared multi-user host, a local unprivileged attacker pre-creates a symbolic link at the predictable /tmp path that nnn's pdfread or nuke plugin will use (derived from the input file's basename for pdfread, or the PID-based /tmp/nuke_$$ for nuke). When the victim later opens a PDF or previews images through those plugins, the plugin follows the symlink and truncates/overwrites the link target with the victim's privileges, corrupting any file the victim can write. No confirmed working exploit code is identified, though the vulnerable code paths are documented in the VulnCheck advisory and the linked source lines.