Live › vulnerability › CVE-2026-119653
Nging through 5.3.5 has an endpoint, /user/autocomplete_path, that lists directories for any path a user supplies. A logged-in backend user without file-manager permission can enumerate directories the Nging process can read and confirm that specific files exist.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 15:31 UTC. All times on this page are UTC.
Any deployment of Nging up to and including 5.3.5 with backend user accounts that are not fully trusted is exposed. Installations where only administrators have backend accounts carry much less risk. The sources do not say whether a fixed release exists.
No product ranges from the sources yet.
5.3.5 and below./user/autocomplete_path route in the deployed Nging backend.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.
This page as .md · .json · in your agent: get_signal("CVE-2026-119653")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.