{"id":"CVE-2026-119653","kind":"vulnerability","aliases":["CVE-2026-119653"],"related":[],"title":"Nging: authenticated users can list server directories via autocomplete endpoint","description":"Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.","summary":"Nging through 5.3.5 has an endpoint, /user/autocomplete_path, that lists directories for any path a user supplies. A logged-in backend user without file-manager permission can enumerate directories the Nging process can read and confirm that specific files exist.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nging","other","self-hosted"],"not_affected_if":["nging-above-5.3.5","no-backend-users"],"how_to_check":"- Check the installed Nging version against `5.3.5` and below.\n- Look for the `/user/autocomplete_path` route in the deployed Nging backend.","fix":null,"status":"open","published_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","triaged_at":"2026-10-30T15:33:41+00:00","updated_at":"2026-10-30T15:33:41+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-30T15:33:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Nging: authenticated users can list server directories via autocomplete endpoint","impact":"low","summary":"Nging through 5.3.5 has an endpoint, /user/autocomplete_path, that lists directories for any path a user supplies. A logged-in backend user without file-manager permission can enumerate directories the Nging process can read and confirm that specific files exist.","audience":"businesses","category":"other","nicknames":[],"who_cares":["nging","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker maps server directories and confirms which files exist","analyst_note":"Confirm whether a fixed Nging release exists and which version; the sources give no fix version.","how_to_check":"- Check the installed Nging version against `5.3.5` and below.\n- Look for the `/user/autocomplete_path` route in the deployed Nging backend.","plain_action":"","needs_analyst":true,"not_affected_if":["nging-above-5.3.5","no-backend-users"],"who_is_affected":"Any deployment of Nging up to and including 5.3.5 with backend user accounts that are not fully trusted is exposed. Installations where only administrators have backend accounts carry much less risk. The sources do not say whether a fixed release exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000662,"input_tokens":4145,"output_tokens":495,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119653':13A,16A '-2026':12A,15A '/user/autocomplete_path':28B,87C '5.3.5':24B,65C 'abus':82C 'allow':72C 'arbitrari':100C 'authent':2A,74C 'autocomplet':9A 'backend':42B,75C 'confirm':58B,115C 'contain':66C 'cve':11A,14A 'directori':7A,31B,51B,80C,108C 'disclosur':69C 'endpoint':10A,27B,88C 'enumer':50B,107C 'exist':62B,118C 'file':46B,61B,95C,117C 'file-manag':45B,94C 'host':21B,79C 'inform':68C 'list':5A,30B,78C 'log':40B 'logged-in':39B 'low':90C 'low-privileg':89C 'manag':47B,96C 'nging':1A,17B,22B,53B,63C,112C 'paramet':105C 'path':34B,101C 'permiss':48B,97C 'privileg':91C 'process':54B,113C 'public':85C 'public-tag':84C 'queri':104C 'read':56B 'readabl':109C 'self':20B 'self-host':19B 'server':6A 'specif':60B,116C 'suppli':37B,99C 'tag':86C 'user':3A,36B,43B,76C,92C 'via':8A 'vulner':70C 'without':44B,93C","nicknames":[],"mitigations":[],"who_affected":"Any deployment of Nging up to and including 5.3.5 with backend user accounts that are not fully trusted is exposed. Installations where only administrators have backend accounts carry much less risk. The sources do not say whether a fixed release exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T15:16:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119653","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119653","severity":null,"published_at":"2026-10-30T15:16:48+00:00","modified_at":"2026-10-30T15:16:48+00:00","first_seen_at":"2026-10-30T15:31:10+00:00","fetched_at":"2026-10-30T15:31:10+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}