EUVD-2026-115895Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account on shared host
-
ExploitPre-create /tmp/nnn.fifo as symlink
-
ExecutionVictim launches nnn with NNN_FIFO
-
ImpactWrites redirected or browsed paths leaked
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Symlink resolution safety
|
| Exploitation Conditions | Requires all of: (1) the attacker holds an unprivileged local account on the same host and can write to /tmp; (2) the victim runs nnn 5.3 or earlier with the NNN_FIFO preview/FIFO feature in use at the documented predictable /tmp/nnn.fifo path; and (3) the attacker pre-creates that path as a symlink to a victim-writable file or as an attacker-readable regular file before the victim launches nnn. Limiting factors: exploitation is impossible without the FIFO feature being configured, depends on active victim interaction (launching nnn), requires same-host local access, and impact is bounded to files the victim can already write and to the victim's browsed paths. |
| Impact | Low real-world priority. The input CVSS 4.0 base score is 1.0 and the vuln.today decision label is 'monitor', both consistent with a hard-to-leverage local flaw. The 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:A) requires the attacker to already hold a local account on the same host, to pre-position a file before the victim acts (AT:P), and depends on active victim interaction (UI:A) - namely the victim launching nnn with the FIFO feature in use. No EPSS score is provided, the CVE is not in CISA KEV, and no public exploit is identified in the input, so there is no signal of widespread or automated exploitation. Impact is capped at low confidentiality and low integrity (leaking browsed paths or overwriting files the victim can already write) with no availability impact, reinforcing that this is a genuine but minor local issue rather than an urgent one. |
| Exploit ScenarioDerived | A local attacker on a shared host pre-creates the predictable /tmp/nnn.fifo as a symlink pointing to one of the victim's writable files (or as a readable regular file). When the victim later runs nnn (through 5.3) with the NNN_FIFO feature, nnn opens that existing path without confirming it is a FIFO, so the victim's writes are redirected to overwrite the symlink target or the victim's browsed paths are exposed via the attacker-readable file. Exploitation is constrained by AC:L/AT:P and requires active victim interaction (UI:A); no public exploit is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
Local file-write redirection and path disclosure in the nnn terminal file manager (through version 5.3) affect users who enable the NNN_FIFO preview/FIFO channel. An attacker holding an unprivileged local account and write access to /tmp can pre-create the documented, predictable /tmp/nnn.fifo path as a symlink or an attacker-readable regular file before the victim starts nnn, so that writes nnn makes to that path overwrite files the victim can already write to or expose the victim's browsed paths; exploitation requires the FIFO feature to be in use and depends on the victim launching nnn. No public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed severity is low (CVSS 4.0 base 1.0; our CVSS 3.1 assessment AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N; vuln.today priority label: monitor).
RemediationAI
The vendor states a patch is available; the upstream fix is the commit 04715921aece0257fef7a8558c0783493d98efff, which adds O_NOFOLLOW plus an S_ISFIFO fstat check in a new open_fifo() helper and validates the FIFO path at startup (lstat, S_ISFIFO, access) - an upstream fix is available via commit/PR, and a released patched version number is not independently confirmed in the supplied data, so build from or update to a revision that contains this commit and track https://github.com/jarun/nnn/issues/2188 and the advisory https://www.vulncheck.com/advisories/nnn-through-5.3-symlink-following-write-via-nnn-fifo-handling. Because the risk exists only when the FIFO feature is enabled on a predictable world-writable path, users who cannot update should stop setting NNN_FIFO (disabling the preview/FIFO integration entirely, at the cost of losing that feature) or point NNN_FIFO at a per-user private directory rather than /tmp so that no other local account can pre-create the path; the same commit also replaces predictable plugin temp files in nuke and pdfread with mktemp -d directories, so those plugins should be updated alongside the binary.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
nnn is a terminal file manager that can publish preview/selection updates over a named pipe: when the NNN_FIFO environment variable (or the documented default path /tmp/nnn.fifo) is configured, nnn opens that path write-only and streams path information into it for external preview consumers. The flaw is CWE-59 (link following): in nnn 5.3, main() accepted a pre-existing NNN_FIFO path after only an access(W_OK) check, and the FIFO writer opened it with plain open(..., O_WRONLY|O_NONBLOCK|O_CLOEXEC) without first verifying with lstat/fstat that the object is actually a FIFO, so a symlink or a regular file planted at that predictable location is followed and written through. The upstream fix at commit 04715921aece0257fef7a8558c0783493d98efff introduces an open_fifo() helper that adds O_NOFOLLOW (where available) and rejects anything whose fstat mode is not S_ISFIFO, and hardens the startup path so that mkfifo success/failure, lstat, S_ISFIFO and access(W_OK) are all checked before use; the same commit also moves the nuke and pdfread plugin temporary files into mktemp -d directories and quotes filenames in the togglex plugin. The CPE cpe:2.3:a:jarun:nnn:*:*:*:*:*:*:*:* covers nnn releases up to and including 5.3; the vulnerable behaviour only matters when the FIFO feature is enabled and the path is on a world-writable location such as /tmp.
Know when Nnn gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Local co-resident attacker (AV:L, PR:L) must pre-position a file and rely on the victim launching nnn (UI:R, AC:H); impact limited to low confidentiality and integrity, no availability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo path as a symlink or readable regular file, causing victim-writable files to be overwritten or leaking the victim's browsed paths.
Threat Intelligence Overview
NVD
CVE.org
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Arbitrary command execution in nnn through 5.3 (CVSS 8.4 High) occurs when the togglex plugin processes selected filenam
OS command injection in nnn file manager version 5.2 allows arbitrary shell command execution when a victim navigates to
Shell command injection in nnn file manager version 5.2 allows an attacker who controls a directory name on a shared fil
The pdfread and nuke plugins shipped with nnn through version 5.3 write to predictable, name- and PID-derived paths unde
Integer truncation in the nnn terminal file manager (version 5.2 confirmed vulnerable) allows a local attacker who contr
Out-of-bounds write in nnn terminal file manager version 5.2 allows a local attacker who can place a malicious session f
Exploit-DB