{"id":"CVE-2026-121549","kind":"vulnerability","aliases":["CVE-2026-121549"],"related":[],"title":"nnn: pdfread and nuke plugins let local users overwrite files via /tmp symlinks","description":"nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived path so the victim's plugin truncates and overwrites any file the victim can write.","summary":"The pdfread and nuke plugins for the nnn terminal file manager create temporary files at predictable paths in /tmp. A local attacker can pre-create a symlink at that path so the plugin truncates and overwrites any file the victim can write.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","macos","nnn","package","shared-hosts"],"not_affected_if":["nnn-newer-than-5.3","plugins-not-installed","single-user-machine"],"how_to_check":"- Check the installed nnn version with `nnn -V` and compare it against the range in the sources.\n- Look for the pdfread or nuke plugins in the plugin directory and confirm whether they are in use.","fix":"- Patch referenced in the sources (github.com); the fixed version number is unknown.","status":"open","published_at":"2026-11-03T16:17:26+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:24:22+00:00","updated_at":"2026-11-03T16:24:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:24:22Z","model":"claude-haiku-5-5","output":{"fix":"- Patch referenced in the sources (github.com); the fixed version number is unknown.","reach":"local","title":"nnn: pdfread and nuke plugins let local users overwrite files via /tmp symlinks","impact":"medium","summary":"The pdfread and nuke plugins for the nnn terminal file manager create temporary files at predictable paths in /tmp. A local attacker can pre-create a symlink at that path so the plugin truncates and overwrites any file the victim can write.","audience":"developers","category":"package","nicknames":[],"who_cares":["nnn","linux","macos","shared-hosts"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local user overwrites any file the victim can write","analyst_note":"","how_to_check":"- Check the installed nnn version with `nnn -V` and compare it against the range in the sources.\n- Look for the pdfread or nuke plugins in the plugin directory and confirm whether they are in use.","plain_action":"","needs_analyst":false,"not_affected_if":["plugins-not-installed","single-user-machine","nnn-newer-than-5.3"],"who_is_affected":"Only machines where nnn 5.3 or earlier is installed with the pdfread or nuke plugin enabled are exposed. The attacker needs a local account on the same machine and must race the predictable /tmp path. Systems without these plugins, or where nnn is not installed, can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000686,"input_tokens":4180,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121549':16A,19A '-2026':15A,18A '/tmp':12A,45B,97C '5.3':72C 'allow':86C 'attack':48B,88C,98C 'contain':73C 'creat':38B,52B,102C 'cve':14A,17A 'deriv':109C,113C 'exploit':93C 'file':10A,36B,40B,65B,77C,91C,124C 'host':26B 'insecur':75C 'let':6A 'linux':20B 'local':7A,47B,87C 'maco':21B 'manag':37B 'name':108C 'name-deriv':107C 'nnn':1A,22B,34B,70C 'nuke':4A,30B,83C 'overwrit':9A,63B,90C,122C 'packag':23B 'path':43B,57B,95C,114C 'pdfread':2A,28B,81C 'pid':112C 'pid-deriv':111C 'plugin':5A,31B,60B,84C,119C 'pre':51B,101C 'pre-creat':50B,100C 'predict':42B,94C 'share':25B 'shared-host':24B 'symlink':13A,54B,104C 'temporari':39B,76C 'termin':35B 'truncat':61B,120C 'user':8A 'via':11A 'victim':67B,117C,126C 'vulner':78C 'write':69B,128C","nicknames":[],"mitigations":[],"who_affected":"Only machines where nnn 5.3 or earlier is installed with the pdfread or nuke plugin enabled are exposed. The attacker needs a local account on the same machine and must race the predictable /tmp path. Systems without these plugins, or where nnn is not installed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","macos","medium","nnn","package","sharedhosts"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:26+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121549","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121549","severity":null,"published_at":"2026-11-03T16:17:26+00:00","modified_at":"2026-11-03T16:17:26+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58832,"url":"https://github.com/jarun/nnn/commit/04715921aece0257fef7a8558c0783493d98efff","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58835,"url":"https://www.vulncheck.com/advisories/nnn-through-5.3-insecure-temporary-file-symlink-overwrite-via-pdfread-and-nuke-plugins","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}