EUVD-2026-24633
GHSA-ccfr-97mr-qq8g
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the ~/.local directory. This allows the attacker to inject a malicious .desktop launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
AnalysisAI
Nano text editor creates ~/.local directory with overly permissive 0777 permissions instead of 0700 in environments with permissive umask settings, allowing local authenticated users to inject malicious .desktop launcher files that could lead to information disclosure or unintended actions when processed. CVSS score 2.5 reflects local attack vector and low integrity impact, with active exploitation status unknown and no public exploit code identified at time of analysis.
Technical ContextAI
The vulnerability stems from a directory permission handling flaw (CWE-732: Incorrect Permission Assignment for Critical Resource) in nano's initialization of the ~/.local directory. When nano creates this directory, it fails to explicitly set restrictive permissions (0700, readable/writable/executable only by owner) and instead inherits the process umask, which in permissive configurations can result in world-writable (0777) permissions. This allows other local users on the system to write arbitrary files into the directory. The attack specifically targets .desktop launcher files, which are processed by desktop environments and could trigger unintended application execution or information disclosure through crafted launcher properties. Red Hat reports the issue affects nano on RHEL 6 through RHEL 10 and OpenShift Container Platform 4.
RemediationAI
Apply a patch from Red Hat that explicitly sets directory permissions to 0700 when creating ~/.local directory, regardless of umask setting. Check Red Hat Security Advisory for RHEL 6/7/8/9/10 and OpenShift Container Platform 4 for patched nano package versions via https://access.redhat.com/security/cve/CVE-2026-6842. As a workaround on affected unpatched systems, system administrators can enforce restrictive default umask (0077 or 0027) via /etc/profile, /etc/bashrc, or PAM configuration, which will prevent world-writable directory creation. However, this is a system-wide change that may impact application functionality and requires careful testing. Alternative workaround for high-risk systems: disable .desktop file processing in the desktop environment configuration if not required, though this limits desktop functionality. The most reliable mitigation is applying the vendor-released patch once available.
More in Red Hat Enterprise Linux 10
View allRemote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Privilege escalation via authentication bypass in libssh affects servers that enable GSSAPIKeyExchange, where the gssapi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today