CVE-2026-121549

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-121549", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-03T14:46:14.234Z", "datePublished": "2026-11-03T15:17:08.749Z", "dateUpdated": "2026-11-07T03:08:53.973Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-03T15:17:08.749Z"}, "datePublic": "2026-10-31T00:00:00.000Z", "title": "nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins", "descriptions": [{"lang": "en", "value": "nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Insecure Temporary File", "cweId": "CWE-377", "type": "CWE"}]}], "affected": [{"vendor": "jarun", "product": "nnn", "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThanOrEqual": "5.3", "versionType": "custom", "status": "affected"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/jarun/nnn/issues/2188", "tags": ["issue-tracking"], "name": "GitHub Issue #2188"}, {"url": "https://github.com/jarun/nnn", "tags": ["product"]}, {"url": "https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff", "tags": ["patch"], "name": "Fix commit"}, {"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10", "tags": ["technical-description"]}, {"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins"}], "credits": [{"lang": "en", "value": "George Chen", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/jarun/nnn/issues/2188", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-07T03:08:30.473969Z", "id": "CVE-2026-121549", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T03:08:53.973Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-121549", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-07T03:08:30.473969Z"}}}], "references": [{"url": "https://github.com/jarun/nnn/issues/2188", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-07T03:08:49.468Z"}}], "cna": {"title": "nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins", "credits": [{"lang": "en", "type": "finder", "value": "George Chen"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 4.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "jarun", "product": "nnn", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "5.3"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-31T00:00:00.000Z", "references": [{"url": "https://github.com/jarun/nnn/issues/2188", "name": "GitHub Issue #2188", "tags": ["issue-tracking"]}, {"url": "https://github.com/jarun/nnn", "tags": ["product"]}, {"url": "https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff", "name": "Fix commit", "tags": ["patch"]}, {"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10", "tags": ["technical-description"]}, {"url": "https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins", "name": "VulnCheck Advisory: nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-377", "description": "Insecure Temporary File"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-03T15:17:08.749Z"}}}, "cveMetadata": {"cveId": "CVE-2026-121549", "state": "PUBLISHED", "dateUpdated": "2026-11-07T03:08:53.973Z", "dateReserved": "2026-11-03T14:46:14.234Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-03T15:17:08.749Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "nnn", "vendor": "jarun", "versions": [{"lessThanOrEqual": "5.3", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write."}], "id": "CVE-2026-121549", "lastModified": "2026-11-07T04:17:20.953", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-121549", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-07T03:08:30.473969Z", "version": "2.0.3"}}]}, "published": "2026-11-03T16:17:26.730", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/nnn"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/jarun/nnn/issues/2188"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jarun/nnn/issues/2188"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-377"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "nnn: nnn: Arbitrary file overwrite via insecure temporary file creation in plugins", "id": "2565928", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565928"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-59", "details": ["nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.", "A flaw was found in nnn. The pdfread and nuke plugins create temporary files in shared directories using predictable file paths. A local attacker can exploit this flaw by pre-creating a symbolic link at the intended location, causing the application to truncate and overwrite arbitrary files writable by the user running the plugin."], "mitigation": {"lang": "en:us", "value": "Update to a tagged nnn release containing the fix once available. Until then, avoid the pdfread and nuke plugins, or run nnn with TMPDIR set to a private directory (e.g., via mktemp -d) so the predictable paths cannot be pre-created by other local users."}, "name": "CVE-2026-121549", "public_date": "2026-11-03T15:17:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-121549\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-121549\nhttps://github.com/jarun/nnn\nhttps://github.com/jarun/nnn/blob/v5.3/plugins/nuke#L280\nhttps://github.com/jarun/nnn/blob/v5.3/plugins/pdfread#L9-L10\nhttps://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff\nhttps://github.com/jarun/nnn/issues/2188\nhttps://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins"], "statement": "An insecure temporary file vulnerability was found in nnn's pdfread and nuke plugins, which create temporary files at predictable name- or PID-derived paths in shared directories such as /tmp. A local attacker who can pre-create a symbolic link at such a path can cause the victim's plugin run to truncate and overwrite any file the victim can write. nnn through 5.3 is affected; the fix (upstream commits 0471592/bb2e85e) is not yet in a tagged release.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,5.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "nnn", "source": "cna", "vendor": "jarun"}, "product": "nnn", "vendor": "jarun"}], "created": "2026-11-03T16:45:14.068384+00:00", "updated": "2026-11-06T02:30:14.082644+00:00", "vendors": ["jarun", "jarun$PRODUCT$nnn"]}