CVE-2026-121549
4.4 MEDIUMpublic exploit availablePublished 2026-11-03 · Updated 2026-11-03
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-377
Public exploit & PoC references
All references
- https://github.com/jarun/nnn
- https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280
- https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10
- https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff
- https://github.com/jarun/nnn/issues/2188
- https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- UNSCOREDCVE-2026-106451PoC
- MEDIUMCVE-2026-110234PoC
- UNSCOREDCVE-2026-113713PoC
- LOWCVE-2026-16791
- UNSCOREDCVE-2026-49484PoC
- UNSCOREDCVE-2026-54584PoC
- MEDIUMCVE-2026-55480PoC
- HIGHCVE-2026-62847PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.