CVE-2026-119653: Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocompletepath endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated backend user can exploit it, including low-privileged users who do not have file-manager permission. The endpoint is tagged as public, but exploitation still requires backend authentication.
What information can an attacker obtain?
An attacker can supply arbitrary paths to enumerate directories that are readable by the Nging process. They can also use the behavior to confirm whether specific files exist.
What conditions make an installation exposed?
An installation is exposed if it runs an affected Nging version through 5.3.5, has authenticated backend users, and the Nging process can read directories or files whose names or presence should not be disclosed.