Nging
Monthly
Any authenticated Nging backend user can enumerate host directories and confirm the existence of specific files through the public-tagged /user/autocomplete_path endpoint in versions through 5.3.5, even without file-manager or administrative permission. Supplying arbitrary paths in the endpoint's query parameter returns filesystem matches readable by the Nging process account, exposing directory structure and file names but not file contents. Exploitation requires a valid low-privileged backend login (CVSS 4.0 base 5.3, CWE-862 missing authorization); no public exploit code was identified at time of analysis, and the vendor has published a fix commit.
Any authenticated Nging backend user can enumerate host directories and confirm the existence of specific files through the public-tagged /user/autocomplete_path endpoint in versions through 5.3.5, even without file-manager or administrative permission. Supplying arbitrary paths in the endpoint's query parameter returns filesystem matches readable by the Nging process account, exposing directory structure and file names but not file contents. Exploitation requires a valid low-privileged backend login (CVSS 4.0 base 5.3, CWE-862 missing authorization); no public exploit code was identified at time of analysis, and the vendor has published a fix commit.