EUVD-2026-114069
GHSA-jcvf-cf9r-682f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged backend user
-
ExploitCall public-tagged /user/autocomplete_path endpoint
-
ExecutionSupply arbitrary filesystem paths in query parameter
-
ImpactEnumerate readable directories and confirm file existence
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid but low-privileged authenticated Nging backend account (PR:L); no file-manager or administrative permission is needed because the /user/autocomplete_path endpoint is incorrectly registered as public, so the pre-patch default configuration of Nging through 5.3.5 is exploitable as shipped. The attacker simply supplies arbitrary paths in the endpoint's query parameter. Limiting factors: the attacker must first obtain a backend login, exploitation is confined to directories readable by the Nging process account, and impact is limited to directory enumeration and file-existence confirmation (no file contents, modification, or code execution). The patched build gates the endpoint behind a CheckPerm('user/autocomplete_path') check, so a configured account lacking that permission is denied. |
| Impact | This is a medium-severity information disclosure flaw (CVSS 4.0 base 5.3) whose signals are internally consistent and point to a real but bounded problem. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) and CWE-862 (Missing Authorization) agree with the description: the /user/autocomplete_path endpoint is mis-tagged as public, so any authenticated low-privileged backend user - even one without file-manager permission - can reach it over the network with low complexity and no user interaction. Impact is limited to confidentiality (VC:L; VI:N/VA:N), consistent with directory enumeration and file-existence confirmation rather than read of file contents, write, or code execution. No EPSS score and no CISA KEV entry are provided, so there is no data indicating widespread or active exploitation; the vuln.today decision label is 'this_month' (not act_now/emergency), matching a patch-promptly-but-not-crisis posture. The one factor that raises practical interest is that the flaw was found by VulnCheck and a public technical write-up exists (hackmd), lowering the bar to reproduce. Net: a legitimate access-control bug worth patching on a normal cycle, not a high-CVSS-but-illusory issue, but also not an emergency - the PR:L precondition (a valid backend account) and confidentiality-only impact keep real-world risk moderate. Missing data to note explicitly: EPSS and KEV are absent (absence is not evidence of safety), and no fixed release version number is given beyond the vendor patch commit. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged Nging backend account - for example a self-registered or minimally-provisioned user with no file-manager rights - sends authenticated requests to the public-tagged /user/autocomplete_path endpoint, varying the path query parameter. By observing which paths return directory entries, they map the host filesystem readable by the Nging process and confirm whether specific sensitive files exist. A public technical write-up exists describing the issue; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Any authenticated Nging backend user can enumerate host directories and confirm the existence of specific files through the public-tagged /user/autocomplete_path endpoint in versions through 5.3.5, even without file-manager or administrative permission. Supplying arbitrary paths in the endpoint's query parameter returns filesystem matches readable by the Nging process account, exposing directory structure and file names but not file contents. Exploitation requires a valid low-privileged backend login (CVSS 4.0 base 5.3, CWE-862 missing authorization); no public exploit code was identified at time of analysis, and the vendor has published a fix commit.
RemediationAI
Upgrade to a vendor build that includes commit 6434d026f668bdb5d59db658036fd6febbd29c0c, which registers an auth dependency for user/autocomplete_path and enforces CheckPerm("user/autocomplete_path") inside the handler; the same commit bumps github.com/coscms/webcore to v0.13.3-0.20261023013544-8b6350482844, so verify that dependency is present in the rebuilt binary rather than applying only the handler change. Patch availability is per the vendor advisory and fix commit (https://github.com/admpub/nging/commit/6434d026f668bdb5d59db658036fd6febbd29c0c, https://www.vulncheck.com/advisories/nging-through-5.3.5-directory-listing-disclosure-via-user-autocomplete-path); a separately tagged release version containing the fix is not identified in the available data, so confirm the commit is in the build you deploy. Where upgrading is not immediately possible, block /user/autocomplete_path at the reverse proxy or WAF for all but trusted administrator source addresses - the trade-off is that the file-path autocomplete UI stops working for legitimate users - and audit/limit backend accounts, since the flaw requires a valid login but no special role; note that restricting the route is a stopgap, not a complete fix, and that the vendor's authorization check is the only complete remediation described.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Nging is a Go-based server/website management panel built on the Echo web framework and the coscms/webcore library, which supplies its role-based permission plumbing. The vulnerable handler, AutoCompletePath in application/handler/user/profile.go, is wired up in application/handler/user/init.go and was registered with a public tag rather than being bound to a permission dependency, so the router never enforced an authorization check before the handler read the caller-supplied path parameter and probed the filesystem for matches. The root cause is CWE-862 (Missing Authorization): the endpoint performs a privileged, filesystem-touching operation on a route reachable by any authenticated backend session regardless of that account's role. The upstream fix commit 6434d026f668bdb5d59db658036fd6febbd29c0c adds a RegisterAutoCompletePathAuthDependency helper that calls role.RegisterAuthDependency("user/autocomplete_path", ...), introduces an explicit CheckPerm("user/autocomplete_path") gate inside AutoCompletePath that returns an empty data set or a NonPrivileged error, and bumps the coscms/webcore dependency to a build containing the corresponding role library changes. Because the disclosure is limited to path enumeration and existence checks, there is no integrity or availability impact and no path to code execution described in the available sources.
Know when Nging gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable endpoint with low complexity and no UI, but requires a low-privileged authenticated account (PR:L); impact is limited directory/file enumeration (C:L) with no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB